Anonymity, Security, Privacy & Civil Liberties in IT

Core Concepts & Definitions

1. Anonymity vs. Pseudonymity vs. Privacy

These terms are often confused but serve distinct purposes in digital spaces:

Why it matters: Anonymity is hard to enforce in digital systems (e.g., ISPs log IPs, cookies track you). Pseudonymity is a compromise (e.g., WhatsApp encrypts messages but knows your phone number). Privacy is a legal right (e.g., Nepal’s Right to Information Act, 2064).

2. Security: Protecting Data from Unauthorized Access

Security is the technical safeguard that enables (or breaks) anonymity and privacy. Key mechanisms:

A. Encryption: The Lock on Your Data

How it works: Encryption converts data into unreadable ciphertext using an algorithm and a key. Only someone with the key can decrypt it.

flowchart TD
    A["Plaintext (e.g., 'My password is 123')"] -->|"Encryption Algorithm (AES-256)"| B["Ciphertext (e.g., 'ؤ¥#$%^&')"]
    B -->|"Decryption (with private key)"| C["Plaintext"]

Real-world examples:

• WhatsApp: Uses Signal Protocol for end-to-end encryption. Even WhatsApp can’t read your messages.
• eSewa: Encrypts transaction data during transfer (though servers may store logs).
• Ncell’s "Secure Login": Uses TLS/SSL to encrypt data between your phone and Ncell’s servers.

Weaknesses:

• Key management: If you lose your encryption key (e.g., forgotten password), data is lost forever.
• Backdoors: Governments can force companies to weaken encryption (e.g., Nepal’s 2018 cybersecurity law requiring data localization).

B. Surveillance vs. Security: A Delicate Balance

Surveillance is the monitoring of individuals/groups, often by governments or corporations. It conflicts with privacy but is justified for security.

Ethical Dilemma:

• Pro-security argument: Surveillance stops crimes (e.g., Pathao’s fraud detection uses AI to flag suspicious rides).
• Pro-privacy argument: Mass surveillance chills free speech (e.g., journalists in Nepal avoiding topics for fear of being monitored).

3. Privacy: Legal and Ethical Frameworks

Privacy is not just about hiding data—it’s about consent, control, and legal protection.

A. Key Privacy Laws in Nepal

1. Right to Information Act, 2064 (2007)
   • Grants citizens access to government-held data but does not explicitly protect digital privacy.
2. Electronic Transactions Act, 2063 (2008)
   • Recognizes digital signatures and data protection but lacks strong enforcement.
3. Nepal’s Data Protection Bill (Draft, 2022)
   • Proposes GDPR-like rules (e.g., user consent for data collection, right to be forgotten).
   • Status: Still under debate—Nepal lacks a dedicated data protection authority (unlike India’s DPDP Act).

B. Global Privacy Standards

How Nepal Compares:

• Weak enforcement: No heavy fines for violations (unlike GDPR’s €20M or 4% of revenue).
• Lack of transparency: Many Nepali apps (e.g., Khalti, eSewa) don’t disclose how they share data with foreign servers.

4. Civil Liberties in the Digital Age

Civil liberties (e.g., freedom of speech, assembly) are threatened when:

• Governments censor the internet (e.g., blocking websites).
• Corporations control access (e.g., Netflix geo-blocking in Nepal).
• Algorithms discriminate (e.g., banks denying loans based on social media activity).

Case Study: Nepal’s Internet Shutdowns

Example: During protests (e.g., 2015 fuel price hike), NTC throttled or shut down internet to prevent coordination.

• Impact on civil liberties: Violated freedom of expression (Article 17 of Nepal’s Constitution).
• Technical method: Deep packet inspection (DPI) to block VoIP (e.g., WhatsApp calls) and social media.

flowchart TD
    A["Protesters use WhatsApp to organize"] --> B["Government orders NTC to block VoIP"]
    B --> C["NTC uses DPI to filter traffic"]
    C --> D["WhatsApp calls fail, but SMS works"]
    D --> E["Protesters switch to SMS or VPNs"]

Ethical Question: Is shutting down the internet necessary for security or an abuse of power?

5. Anonymity Tools: How to Stay Hidden Online

Worked Example: Using Tor to Access Blocked Content in Nepal

1. Problem: During the 2021 COVID-19 lockdown, some news sites (e.g., Republica) were blocked.
2. Solution: A journalist uses Tor Browser to access the site.
   • Tor routes their request through 3 nodes: Kathmandu → Singapore → Berlin → Republica’s server.
   • Republica’s server sees the request as coming from Berlin, not Nepal.
3. Risk: If the exit node (Berlin) is compromised, an attacker could see the request.

How Tor routes traffic through 3+ nodes to hide user identity (Image: Tor Project, CC BY 3.0 us, via Wikimedia Commons)

6. Ethical Dilemmas: When Security vs. Privacy Collide

Scenario 1: Contact Tracing Apps (COVID-19)

• Pro-security: Apps like Nepal’s "Swasthya App" track COVID-19 cases to alert users.
• Pro-privacy: Users worry about government misuse of location data.
• Compromise: Apps use bluetooth signals (not GPS) to avoid tracking individuals continuously.

Scenario 2: Facial Recognition in Banks

• Use case: Nabil Bank uses facial recognition for ATM logins.
• Privacy concern: What if the data is hacked or sold?
• Ethical question: Is convenience worth the risk of losing biometric privacy?

In the Real World

1. eSewa’s Privacy vs. Security Trade-off

   • Idea used: Pseudonymity + encryption.
   • How it works: Your name is linked to your eSewa ID, but transactions are encrypted. However, eSewa logs all transactions for fraud detection.
   • Real impact: If a hacker breaches eSewa’s database, they get user IDs + transaction histories (not full names).

2. Khalti’s Data Sharing with Foreign Servers

   • Idea used: Data localization laws vs. cloud storage.
   • How it works: Khalti stores user data on AWS servers in the US, violating Nepal’s draft data localization rules.
   • Real impact: If the US government requests Khalti’s data (e.g., under FISA), Nepal has no legal recourse.

3. Pathao’s Driver Surveillance

   • Idea used: Targeted surveillance for safety.
   • How it works: Pathao uses GPS tracking + AI to monitor driver behavior (e.g., sudden braking).
   • Ethical issue: Drivers argue this is invasive, but Pathao claims it reduces accidents.

Exam Tip

This unit is conceptual but application-heavy. Exams test:

1. Definitions: Differentiate anonymity, pseudonymity, privacy (expect 2-mark questions).
2. Case studies: Relate concepts to Nepal’s laws (e.g., Right to Information Act) or apps (e.g., eSewa, Khalti).
3. Ethical dilemmas: Analyze surveillance trade-offs (e.g., "Is NTC’s internet throttling justified?").
4. Tools: Explain how VPNs/Tor work and their limitations (often in short-answer questions).

Common pitfalls:

• Confusing encryption (security) with anonymity (hiding identity).
• Ignoring legal context (e.g., GDPR vs. Nepal’s weak data laws).
• Overlooking real-world examples—examiners love eSewa, Khalti, or NTC as case studies.

High-scoring strategy:

• Use bullet points for comparisons (e.g., surveillance types).
• Draw diagrams for processes (e.g., Tor routing, encryption flow).
• Link to Nepal in every answer (e.g., "Like NTC’s throttling, China’s Great Firewall...").

Showing how traffic hops through 3+ nodes to obscure origin (Image: Tor Project, CC BY 3.0 us, via Wikimedia Commons)