IFF writes to the Parliamentary Standing Committee on IT on the “Bulli Bai” and “Sulli Deals” Incidents

tl;dr

The recent “Bulli Bai” and “Sulli Deals” incidents, a fake online auction of almost 100 Muslim women, was a blatant violation of their data security and privacy rights. It severely impacted their constitutional right to life and free speech by displaying sensitive information without consent. Hence, we have sent a letter to the Parliamentary Standing Committee on Information Technology requesting them to investigate the matter to understand the reasons behind the delayed response of the relevant authorities.

Background

The "Bulli Bai" case garnered public outrage on January 1, 2022, when one of the target women of the application filed an FIR against unknown persons with the Mumbai Police. "Bulli Bai", hosted on GitHub, a code-sharing platform, was a tech tool created to demean and humiliate Muslim women. The application aimed to "auction" over 100 women by displaying their doctored photos along with their social media profiles. It attached a "price tag" with every profile and labelled them as "Your Bulli Bai of the Day". The "Bulli Bai" application targeted several women, including a journalist, a pilot, activists, political leaders and the mother of a missing JNU student.

This came barely six months after a similarly horrific "Sulli Deals" case was reported in July 2021, which had a similar modus operandi. "Sulli" is a derogatory term used for Muslim women by right-wing extremists. The incident came to light when a Noida-based resident filed a complaint with the local police upon finding her and several other Muslim women's pictures uploaded on this application without their consent. The developers wanted to "auction" almost 80 Muslim women by sourcing their pictures from their social media accounts and defacing them with lewd remarks.  

Below is a brief timeline of the incidents and the action taken by IFF.

Why should you care?

The fake online auction of Muslim women seen in the "Bulli Bai" and "Sulli Deals" incidents show women are still unsafe on the internet. The online harassment meted out to them, and the subsequent delay in content moderation by the involved technology platforms reinforces India's need for more robust data protection and legislation laws. Moreover, the country's wanting state of cyber policing further fails to dissuade such criminal activities. We, at IFF, believe these incidents violate the core fundamental rights of citizens guaranteed under the Indian Constitution.

Violation of Right to Life and Privacy: Article 21 of the Indian Constitution guarantees "protection of life and personal liberty". However, by displaying sensitive information without consent, the application's developers effectively violated a fundamental right of these women. The gender and religion-based targeting of the application were meant to intimidate and harass them. While the women were not "auctioned" in reality, the application reduced them to saleable items. Unsurprisingly, this elicited further lewd and objectionable comments, threatening the women's security and liberty. By leaving them vulnerable to online abuse, the applications also infringed upon their "right to privacy" delivered accorded to every Indian citizen by the Hon'ble Supreme Court's decision in KS Puttaswamy v. Union of India (2017) 10 SCC 1.

Violation of Right to Free Speech and Expression: As per Article 19 1(a) of the Indian Constitution, every citizen is guaranteed the right to free speech and expression. However, online harassment in these incidents may lead to a chilling effect on this fundamental right. The women may feel unsafe to be active social media users and leave the platform altogether. The abuse also increases against politically articulate women, as seen in the "Bulli Bai" and "Sulli Deals" incidents that targeted journalists and human rights activists. According to a study conducted by Plan International, one in every five young women have opted out of social media after being targeted or harassed. The abuses are further aggravated in cases of women who belong to minority communities on social media platforms and dissuade them from expressing themselves without any fear or inhibitions. A recent study by Pew Research Center showed that while Indians essentially believe in religious tolerance of other faiths, they strongly prefer keeping religious communities segregated.

We raised this issue with the Standing Committee

The digital security of the targeted women was compromised due to the delayed response to the online vitriol. Their photos and social media handles were shared on a third-party platform without their consent and were taken down only after the media outrage. As a result, the women faced threats, harassment, and ridicule on their social media platforms. What makes matters worse is the lack of action taken after the "Sulli Deals" incident was reported last year. While the FIR was filed in July 2021, only after six months on January 5, 2022, did DCP KPS Malhotra say that the MLAT procedure "was completed". MLAT, or the Mutual Legal Assistance Treaty, is a treaty between the U.S. and India to improve international cooperation on criminal matters. Though the "Sulli Deals" application creator has been arrested now, the process could have been quicker if GitHub, via MLAT, had helped the Delhi Police with the registrant and IP details of the accused earlier. Such delays further encourage miscreants to continue their harassment with impunity. As per the National Crime Records Bureau's (NCRB) 2020 data, of the 50,035 cybercrimes reported, 10,405 were explicitly against women.

Further, the lack of overarching data protection legislation also leaves a gaping hole in the legal measures to be taken in case of personal data usage violation. There is no clarity on the obligation and governance terms to be followed by technology platforms for the data collected. This exacerbates security and privacy threats and fails to safeguard against data breaches.

Therefore, this breach of citizens' online privacy and security falls squarely within three subjects selected by the Parliamentary Standing Committee on Information Technology for the seventeenth Lok Sabha which are-

1. Citizen’s data security and privacy.
2. Safeguarding citizens’ rights, including special emphasis on women security in the digital space.
3. Review of cyber security scenario in India.

Our recommendations

In light of these two incidents, IFF made a few recommendations to the Standing Committee. While Section 67 of the Information Technology Act, 2000 protects against "publishing or transmitting obscene material in electronic form", the recent developments show it is not enough. The recurrence of such horrific events and the delayed response begs answers to what needs to be done and where the system lacks. Hence, we recommended that the Standing Committee set up an inquiry to investigate the data security and privacy violations committed in the "Bulli Bai" and "Sulli Deals" incidents, which may include the following actions:

1. Invite the victims of these applications, experts on digital rights and online safety to provide testimonies.
2. Call relevant officials from the government and the social media platforms involved (GitHub and Twitter) to discuss their content take-down and online safety policies.
3. Summon the investigating departments (Mumbai, Delhi and Uttar Pradesh Police) to understand the delay in investigation, specifically in the “Sulli Deals” incident.
4. Summon the National Commission for Women and the relevant state commissions (DCW and MSCW) to inquire about the steps taken by them to redress the incidents.  

We believe these measures will help the Committee delve deeper into the issues by looking at them from the perspective of all the involved stakeholders. It will help us ascertain the gaps in the technological and legal procedures to be followed during cyber crimes. Lastly, meeting the NCW and the respective state commissions will provide further details on the preventive measures taken, as it is only through transparency that accountability and justice can be provided to the victims of this incident.

Important Documents

1. Letter to Standing Committee on Information Technology for the inquiry into the “Bulli Bai” and “Sulli Deals” incidents dated January 14, 2022. (link)
2. IFF’s representation to the Mumbai Police dated January 3, 2022. (link)
3. IFF assists Amina targeted by the “Bulli Bai” application. (link)
4. Previous blog post titled “Women’s safety on the internet has to account for intersectionality”. (link)

Note: This post was drafted by Shivangani Misra, a Capstone Fellow hosted at IFF, and reviewed by IFF staffer Anushka Jain.