Naavi.org

Amazon is considered one of the biggest book selling platforms and lists books for sale from many publishers and distributors. However getting registered as a seller in Amazon is with certain formalities and only authorized sellers can sell their wares on the platform.

I am sure that the contract between the seller and Amazon does include prohibition of infringement of copyright or sale of fake products etc. Amazon may claim that they do their due diligence which occasionally may fail. However even in such cases, they should respond when a complaint is received.

However, Amazon.in is not a Cyber Law Compliant organization in India and there is no grievance redressal officer as prescribed under Information Technology Act 2000/8 (Section 79) to whom a complaint can be easily addressed. There are help e-mails but all of them are directed to product buyers and any issues related to the purchase of the product.

I recently came across what I consider as a suspected fraud for which I am seeking the explanation of

1.Amazon.in 

2.Notion Press, Chennai

3. Atlantic Publishers and Distributors, Delhi

4. Bookswagon

Of the above, Atlantic and Bookswagon are selling the book for which I hold the copyright and at a price different from what I have authorized the publisher M/s Notion Press.

Had these publishers taken permission from me or Notion press, and shared the royalty, then it would have been a valid transaction. However they have not.

I am waiting for the response from Notion Press, in particular from Mr Bhargava Adepalley, Naveen Valsakumar and Jana Pillay the Co-founders and also Amazon before coming to a conclusion about their involvement in this fraud.

Naavi

P.S: Since releasing the above note, I have received clarification from Notion Press as follows:

Notion press has withdrawn paper back sales on Amazon temporarily because of the COVID lock down though they continue to take direct orders for which link is available on here

https://notionpress.com/read/personal-data-protection-act-of-india-pdpa-2020

Amazon has therefore opened up the paperback sales from Ingram distributors who are buying the international version and supplying it in India. These books are printed abroad and sent from there and hence the pricing is on international prices converted into INR. Notion Press has assured that the sales will be reported by Amazon in due course to Notion Press and royalty as applicable to international sales would be credited to the author’s account.

I am also informed that after Notion Press resumes supply to Amazon and Flipkart, the book’s local price would reflect.

I thank Mr Naveen Valsakumar, Co Founder and the team for providing me the clarification.

Had Amazon put a footnote that the paperback version is available from outside India when people log in from Amazon.in, this confusion could have been avoided.

I have made necessary edits in the first version of the post.

Naavi

On 14th June 2020, we had a well attended webinar organized by the Cyber Society of India, on Section 65B of Indian Evidence Act. During the webinar, I made a brief presentation on the Techno Legal perspective of Electronic Evidence and Section 65B. It was followed by the talks from some other experts also.

During the discussions several questions had been raised by the participants. Some of them were answered by other experts during the webinar. However, I have collated the questions and provide my view for each of them .

Watch this video first:

If you have more questions, please send it by e-mail.

Naavi

During the Covid lockdown, apart from the Police and the Health workers who are being hailed as “Covid Warriors”, there are also another industry where the employees are keeping the services going despite the enormous risks that the employees are facing. That industry is “Banking”.

Banks have not closed down even during the severe lockdown conditions and for some time there was alternate day working in some Banks. However some banks have now started daily working ignoring the risks posed to the employees.

Though Banks have digitized their operations and the branch transactions have  reduced, some Banks appear to be not taking appropriate measures required to ensure that employees and the customers donot get infected by contact during the physical banking transactions.

Even in places like Mumbai where the Corona infections are on the higher side, some Banks have not taken the necessary measures to curtail the foot falls in the Branches. Reserve Bank of India does not seem to have made any efforts to properly advise the Banks in this regard.

This is high time that customers are advised to make most of their transactions through online and where necessary, contact the Branch manager through video calls.

The employees should be able to log in remotely from their residences to complete the routine transactions. Even the banking transactions can be done through the internet banking system with suitable modifications where an authorized employee with appropriate access controls based on biometrics, face recognition and digital signatures or e-sign, to log in to the Banking system  and conduct shadow transactions which can be later integrated with the CBS after a time delay.

It appears that in the last 3 months, no effort has been made either by REBIT or IDRBT to introduce such alternate secure methods by which employees can work from home.

The CBS software suppliers which include the  major Indian companies also could have worked out a supplementary interface which could enable secure log in to the system remotely without sacrificing the security aspects.

The lack of innovative initiatives from individual Banks and the RBI is disappointing.

In order to understand the preparedness of the Banks to meet a prolonged lockdown, Naavi.org would like to conduct a survey inviting responses from Banks and other professionals in the area to elicit the following kind of information.

I would be happy if the readers can submit the following information.

In this connection I am conducting an online survey and would like to know your responses for the following.

One of the interesting aspects of COVID 19 Lockdown is the emergence of new paradigms in HR. It appears that the HR practitioners need to re-skill themselves in several aspects of motivation and leadership as the established theories are getting outdated.

It is a fact that after three months lockdown as the industries open out, they are receiving an unexpected response from many employees who are preferring to continue the “Work From Home” (WFH) practice as a more long lasting practice. This has set the industries thinking on their long term strategies of employee engagement.

It is a fact that in the IT industry, productivity has not suffered much because of the lock down. Many individual employees have actually improved on their productivity and also achieved better work life balance.

The situation is not the same in manufacturing organizations or where a team effort is critical for creative output.

Also there are people who enjoy the company of their family members and those who are not. This has also given raise to more domestic conflicts.

Nuclear families with responsibility to take care of children are in another peculiar situation where the employers are calling the employees back to work while the schools are not ready for physical classes. Hence looking after the children is another reason why some employees donot want to return to work.

HR also have the problem of new recruitment and possible moonlighting by employees.

All these issues are beside the security issues which the security professionals are trying to address separately.

Legal departments are also struggling with their contracts with the customers and how to accommodate WFH into their contracts.

An interesting discussion was held by FDPPI under its Jnaanavardhini series of webinars on 10th June 2020 where a Behavioural science trainer discussed the HR issues arising out of the Covid.

In the coming days, we may have to classify our present and prospective employees who may be technically skilled to use technology for work as two principal types namely the “Lone Wolf” and “Hunter in Pack”. or the “Family Type” and “Company Type”

The Lone wolf will be happy to work from home and deliver. He may sleep upto 9.00 am, does not shave, works in shorts, but works upto 2.00 am in the night to finish the task given to him. As long as the task is well defined, he is happy to work alone. This is best suited for individual software employees who need to code.

The Hunter in Pack however needs peer nudging to activate his creativity and will go into depression if he is not with the team.

These attitudes may also reflect in whether a person has a happy family to support him or depends on the work place facilities like the canteen the gym etc.

A recruiter therefore has to design methods of identifying the type of employee and fit him into the corporate environment. The “Return to Workspace” option also has to be designed to meet the type of employee and the nature of his activities. Projects may have to be redefined as “Team Only”, “WFH compatible” etc.

The team leads also need to be comfortable with the different types of engaging with the team members. They have to be adept both in physical brain storming meetings as well as the virtual meetings.

Probably we need to design specific training programs to develop a new “Virtual Leadership” capabilities which will help the leader to “Virtually Motivate” his employees into action.

These are new areas of research and perhaps we need to add to the current motivational and leadership theories.

There is also a challenge when we recruit some body under the Covid conditions, train them up and later we have to move back into the old system. The some of the people who are well entrenched into the current work-life balance will consider giving up their jobs solely for the reason of the change and there could be a new attrition challenge to address.

The software development companies will be critically hit in such migration from corporate work space to home workspace.

The trend is like the “Stockholm Syndrom” exhibited by kidnap victims as more and more COVID lockdown victims start falling in love with the new paradigm of work. This could both be a threat and an opportunity for the innovative HR Professionals.

It looks exciting opportunities ahead for HR managers who can think differently and adopt their skills to the new environment. Management schools have to look at “HR Management in a Virtual Environment” as a new area of specialization.

Let us keep our thoughts on this emerging area of learning which is as important as “Security or Privacy Management in a Virtual Environment”

Naavi

In the recent days, i came across two instances where the logistics companies used an OTP to get an acknowledgement of delivery. First was the case of Reliance Digital or the Jio Mart. Second was BlueDart.

In both cases after the delivery, an OTP was sent to the customer and he was asked to reveal the OTP to the courier boy so that he would input the OTP from his mobile as confirmation of the delivery.

This goes against the general principle of caution that we try to educate the consumers with, that they should not share OTP with anybody.

If we develop this habit of courier boys asking for OTP, then we will be opening a new channel of fraud where the OTP may actually be sent just in time to carry out some fraud and the consumer may fall a victim.

I therefore request these big companies to stop this practice. They can however have some other way of obtaining the confirmation including the customer himself confirming receipt directly to the company.

If this practice is not stopped these companies will be indirectly responsible for such OTP stealing frauds if any.

Naavi

Here is another case of a hacker admitting publicly an offence for which he may get 3 to 7 years of imprisonment and challenging the Indian Government. The MeitY is not strong enough to either secure their systems nor prevent Indian software professionals trying to use the Government projects as target practice for testing their hacking skills.

In the bargain the Indian Government under Mr Modi appears to be powerless against people who are specifically targeting the Indian Government assets and exposing the other citizens to great risk.

I draw the attention to the article   https://yetanothersec.com/blog/2020/06/03/digilocker-disclosure/

which has highlighted the exploits of  Sri Mohesh Mohan, Senior Security Specialist for Dubai Smart Government.

I have no doubt that this person is a talented security specialist and his website (https://www.h4hacks.com/) may have proof of his talent. However, he represents that category of technology experts who are suffering from “Technology Intoxication” and focus their energies on hacking Government projects particularly of India because the Indian Government is meek in dealing with such persons.

In his article he admits that he was motivated by the “Competitive Hacking Urge” that he felt when the  another software person from Bangalore announced that he has hacked the Aarogya Sethu app.

He has then targeted the digi locker app after downloading it . Rest of the article describes the modus operandi of the hacking just like how a psychopath describes how he murdered a person.

The fact that this person is proud of his act makes me wonder about the ethics of professionals.

I want to question the Dubai Government if it has assisted this person to hack the Indian Government assets by providing him any hardware, software, wifi connectivity etc., if so whether they would take the responsibility for the hacking.

It is clear that because the Aarogyasethu authorities handled the earlier hack with kid gloves, it has encouraged this hacking. Hence we should hold the officials who did not take stringent action on the AarogyaSetu hacker for encouraging Mr Mohesh Mohan for complicity in this fraud.

I am a DigiLocker holder and this hack has directly compromised my security for which I am entitled to claim damages from the Government of Indaia.

I seek an answer from the person in charge of the Digi Locker project, National e-Governance Division, MeitY on what action they intend taking against this hacker.

Has the Meity got Digilocker notified as a “Protected System” under Section 70 of ITA 2000?

Has the terms and conditions of use of Digilocker prohibit the downloading for reverse engineering and hacking purpose?

Is there a privacy policy and terms of use before the citizen first provides his Aadhaar number to the Digilocker authorities when some body downloads the app?

I would like to know from the Secretary of MeitY who will be held responsible for exposing mine and several lakh fellow Indian’s confidential information to the hacker who may sell it in the darkweb?

The reply from CERT-IN that the vulnerability has been plugged confirms that the vulnerability did exist and is a damning evidence against the Digilocker authorities.

The reply of the digilocker team is funny as it says “No account other than that of the attacker was used”. It does not say that the information of the 3 billion documents were not accessed by the hacker. The reply also says that the data is “Safe and Secure”. It is difficult to understand how  compromised data is considered “Safe”.

The digilocker team does not perhaps understand that keeping data safe and not the data owner’s safe is not  acceptable Techno Legal security.

The incident calls for  a severe disciplinary action against the digilocker team along with initiation of criminal action against the hacker.

I am forwarding this article to the concerned persons and await their reply.

I hope  MHA also takes necessary action since this incident is a crime which causes a serious concern for Indian citizens if their critical personal information such as the Aadhaar data, PAN data, Driving license data etc are safe.

Naavi

P.S: I have sent the following e-mail to digital locker team:

To: support@digitallocker.gov.in

Dear Digitlocker team

I have also sent the following message to CERT-IN:

To: incident@cert-in.org.in

To