Thread by @iam_anandv

Catching up on @cobrapost expose on @Paytm . Long ago, I learnt that, when others see features, security professionals see vulnerabilities. The govt. is a big vulnerability for all regulated businesses. And most requests in India, are verbal. It is a fact of life. /1

So if we expect businesses to only give up user data on court orders, then I guess, we have not run a regulated business. It is easy to outrage about the video, but can you actually deny the verbal request and survive as a business? 100%, the answer is no. Why is it so? /2

That is the power of regulation. We have not organized sufficiently (meaning enough people don't care) to demand these type of behavior from govt. So biz. faces a choice of shutting down vs taking some ethical choice, which enough don't care. So Delete PayTM won't work at all /3

However I am long term optimistic and short-term pessimistic. In the long run, these things will make a difference, though not much in the short term. A policy change proceeds by incremental mistakes made by various players and how public respond to it (very important). /4

To put things in perspective, the Irish abortion act has been in existence for very long and Savita's case was the turning point, but it took decades for the overturning to happen. Same here. FWIW, I never had a @PayTM account because I did not cashbacks 😀 and vulnerabilities /5

Finally, it also points out how stupid @UIDAI's denials are. Particularly this trope that Pandeyji put out in @IndianExpress. With a unifying number, UIDAI did not had to know. All it needs is one call /6
indianexpress.com/article/india/…

This is why I like @pranesh. He used to argue that surveillance is possible w/o Aadhaar and he is right. But with Aadhaar, it is now ridiculously easy. Just one call with a set of Aadhaar numbers and anyone in the govt. can know, not just the car you purchased, but a lot more /7

This is why Mr.Divan argued in the court, that it is about the architecture of surveillance, made easy, at a scale never possible before. I doubt if the court and the SC judges, understood this point, as it is very nuanced. Won't be surprised, if they did not. /8

The tech. community think about APIs and architecture, but not about "Verbal orders". It is a blind spot, they have not been able to understand. Most businesses (financials, health) are regulated. And regulated means "One Phone call". That is the scary lesson. /9

So delete paytm if it feels good. But the problem lies elsewhere. And next time, when you ask for regulation of a sector, remember the vulnerability it creates. "One Phone call". Unlike an algorithm, the vulnerability can't be fixed because it is also called democracy😀
#