Good Wishes on Data Privacy Day

Data Privacy Day is being celebrated since 2018 across the globe to increase the awareness about Privacy.

With the Personal Data Protection Act (PDPA-2018) under process, India is taking a significant step towards bringing in a comprehensive data protection regulation which is a step ahead of the global regulation including GDPR.

But we need to remember that Data Protection Act in India actually came into being on 17th October 2000 in the form of Information Technology Act  2000 which gave protection to all data including personal data, sensitive personal data and other data by providing civil compensation under section 43 and criminal punishments under Section 66. This was further strengthened on 27th October 2009 with Section 43A, Section 72A in particular and other sections such as Section 67C etc.

Let us celebrate the international data privacy day of 2019 with the expectation that before the year is out, India will have its own Privacy Act.

Naavi

Posted in Cyber Law | Leave a comment

The EVM Hacking…..Despicable Lies to Soften Targets

It is terribly unfortunate that the Congress Party under Sonia/Rahul has turned one of the biggest enemies of the country just because it wants to capture power. While it is its right to fight the election and win, it has no right to undermine the country the way they are doing now.

The so called Cyber Expert Syed Shuja in association with the Indian Journalists Association, UK, under the watchful eyes of Mr Kapil Sibal, made many statements that Indian EVMs were programmed for hacking and used in 2014 by BJP to win the elections. He also made statements that the opposition parties are also aware of this but they were very honest and did not use it when they won the recent elections in Madhya Pradesh, Rajasthan and Punjab. Also he stated that Gauri Lankesh in Bangalore who was shot probably because of some difference with her Naxal friends and Gopinath Munde who died in a road accident were both murdered because they knew that EVM could be tampered. Perhaps he thinks no body else in BJP or in the opposition knew it and hence were not murdered.

The claims are so childish that even a discussion on the same appears a needless recognition for this anti India tirade.

I would like to however discuss a related aspect which is that Congress has been adopting a psychological strategy to soften the institutional heads and turn them into either their supporters or at least make them incapable of taking necessary actions in the course of their duty which may go against the Congress.

The strategy starts with spreading lies and accusing a person in charge of an important office of being corrupt and favouring BJP. Continue it’s campaign with the help of some part of the bought over media until the honest person gets so disgusted that he will be over come with decision paralysis.

They first tried this effectively against the previous CJI by bringing about an impeachment discussion though they knew that it could not progress. They then withdrew it but gave a notice to the other Judges that if they donot toe the line of Congress, there would be an impeachment action against them also along with mis-information in the media.

They thus softened the Supreme Court which today agrees to take up any issue brought up by the Congress advocates and issues notices to the Government even if the matter is meaningless. Supreme Court has also been obliging in postponing the National Herald Case and the Ayodhya case endlessly to suit the Congress. In the bargain the credibility of the Supreme Court has been hurt.

They attacked CVC during the Alok Varma dispute and made it look as if CVC office itself is unreliable. CVC has already been discredited because CVC reports on the UPA scams are well known.

Now Congress is targeting the Election Commission by targeting the EVMs. If EVMs were being tampered for the last 5 years, all Election Commissioners who held the office should also be compromised.

The claims made by Syed Shuja are so absurd that it does not merit any serious discussion. But it can be a gossip which can keep circulating and used by the politicians in their public speeches.  This is a strategy which Congress is pursuing and will be reasonably successful also.

Many people in the professional circles are falling prey to this propaganda and advocating various measures which will dilute the credibility of the Indian Election Commission.

We request professionals to raise above their individual political views and ensure that false technology narratives are not used to discredit our country’s apex institutions.

I wish the Government/ECI takes immediate legal action against the Indian Journalists Association, UK and Syed Shuja, as well as Kapil Sibal for  direct or indirect association with the false propaganda.

Naavi

Reference

Solution to EVM Controversy

Clarifications on Cyber Law Compliancy of EVMs

Hacking and Indian Elections

Hacking of EVMs is Cyber Terrorism

Bring Your own Virus infected Computer and say all computers can be tampered!

 

Posted in Cyber Law | Leave a comment

Umashankar Judgement upheld by TDSAT

S Umashankar Vs ICICI Bank was a historic adjudication decision of the Adjudicator of Tamil Nadu in decided in 2010 (Complaint filed in 2008). The award had held ICICI Bank liable to pay compensation to the customer because the Bank was negligent and caused the loss despite the incident also involving a phishing element.

The Bank had appealed against the order  with Cyber Appellate Tribunal (CyAT). Unfortunately, just before the judgement to be given in CyAT, the then Chairman attained superannuation in June 2011 and the operations of CyAT stopped completely. Two successive Governments could not find a replacement for the chairman until in 2017, CyAT was merged with TDSAT.

TDSAT reopened the proceedings on 31st July 2018 and yesterday the 10th January 2019, pronounced the judgement upholding the Adjudication order though it reduced a part of the compensation granted by the AO on expenses account.

With this a 10 year fight for justice of a Cyber Crime victim appears to have reached a decisive stage though the mop up operations by way of execution of the decree need to be completed.

Naavi

[Update: A review had been filed on the decision as regards the interest payable for the intervening period since the adjudication order upto the TDSAT order. The order dated 3rd April 2019, provided the interest relief. Watch for further updates if any.]

 

Posted in Cyber Law | 5 Comments

Virtual Cards for Credit Cards also

RBI has issued  guidelines on tokenisation for debit / credit / prepaid card transactions as a part of its s endeavour to enhance the safety and security of the payment systems in the country.  Accordingly RBI will permit  authorised card payment networks to offer card tokenisation services to any token requestor (i.e., third party app provider), subject to certain conditions.

This permission extends to all use cases / channels [e.g., Near Field Communication (NFC) / Magnetic Secure Transmission (MST) based contactless transactions, in-app payments, QR code-based payments, etc.] or token storage mechanisms (cloud, secure element, trusted execution environment, etc.). For the present, this facility shall be offered through mobile phones / tablets only. Its extension to other devices will be examined later based on experience gained.

 All extant instructions of Reserve Bank on safety and security of card transactions, including the mandate for Additional Factor of Authentication (AFA) / PIN entry shall be applicable for tokenised card transactions also.

All other instructions related to card transactions will continue to be  applicable.  for tokenised card transactions as well.

The ultimate responsibility for the card tokenisation services rendered rests with the authorised card networks.

No charges should be recovered from the customer for availing this service.

Before providing card tokenisation services, authorised card payment networks shall put in place a mechanism for periodic system (including security) audit at frequent intervals, at least annually, of all entities involved in providing card tokenisation services to customers.

This system audit shall be undertaken by empanelled auditors of Indian Computer Emergency Response Team (CERT-In) and all related instructions of Reserve Bank in respect of system audits shall also be adhered to.

A copy of this audit report shall be furnished to the Reserve Bank, with comments of auditors on deviations.

The move is welcome since it is expected to enhance the security from the consumer’s point of view.

Naavi

Posted in Cyber Law | Tagged , , | Leave a comment

Limited Liability also for Cyber crimes in PPI

The Reserve Bank of India has issued a circular “Customer Protection – Limiting Liability of Customers in Unauthorised Electronic Payment Transactions in Prepaid Payment Instruments (PPIs) issued by Authorised Non-banks” on January 4, 2019.

This is similar to the circular earlier issued for Banks and cooperative Banks

Accordingly, if the victim of a Cyber Crime informs the PPI issuer within 3 days, there shall be no liability.

Naavi

Posted in Cyber Law | Leave a comment

An innovative way of implementing the Intermediary Guidelines under Section 79

We are all aware of UDRP or INDRP which is a Dispute Resolution Policy adopted by all Domain Name Registrars for resolving disputes arising out of conflicting domain name registrations. The policy is embedded into all domain name registration contracts and resolved through an Arbitration process.

This procedure  which has been in existence since August 1999  and has been in use across not only the GTLDs but also the other TLDs and CCTLDs. The domain name registrations of these different TLDs are under several complicated covenants built into the domain name contracts and disputes arising thereof are resolved through mediation and arbitration.

A similar procedure appears to be also good for imposing the “Due Diligence” requirements under the Intermediary Guidelines under Section 79. Since the Government is now considering some modifications in the Intermediary guidelines, it is a good time to think about introducing this IDRP (Intermediary Dispute Resolution Policy) procedures as explained briefly below.

  1. The IDRP process would envisage that all intermediaries in their terms and conditions add one clause that the provision of the service and dispute resolution arising there of will be subject to IDRP.
  2. IDRP will be drafted by the Accredited IDRP Management Centers(like the WIPO arbitration center in case of domain names). These IDRP management Centers would be like “Accredited Arbitration Councils” and will adopt a well developed system of “Providing an Ombudsman”, “Mediation” and “Arbitration” as per the arbitration act of India.
  3. These IDRP s will incorporate all the Due Diligence Clauses which are included in the Intermediary Guidelines and hence without the entire list of clauses being repeated in all the terms and policy documents across websites and Apps the single clause of IDRP adoption will adopt the entire due diligence requirements.
  4. The Intermediaries should then be required to register themselves with the Government. Since according to the newly proposed guidelines, large Intermediaries need to have an establishment in India and those handling personal information will be subject to data localization, registration of significant and guardian fiduciaries etc., this proposal to get registered so that the Government has an inventory of such intermediaries is not difficult. Apart from the voluntary registration from the intermediaries, the IDRP Resolution Centers may be tasked at ensuring that an awareness is created and all identifiable intermediaries are registered and undertake to add the IDRP clause in their terms.
  5. In case any intermediary does not want to register and add IDRP clause, it will still be subject to the intermediary guidelines which they need to adopt and comply with but without the benefit of the ADR process.
  6. The IDRP process should be made entirely online and ODR mechanism (See www.odrglobal.in for more information) should be adopted. [P.S: Adoption of ODR mechanism in this process will provide a leadership status for India in adoption of this emerging best practice in dispute resolution and reduce the burden on the Indian Courts.]
  7.  The terms and conditions that the intermediaries will be required to handle after adoption of this practice will consist of only the business related issues and the intermediaries will find it convenient to ensure that the burden of drafting a compliance related terms and conditions by availing the services of a Cyber Law expert  is fully eliminated.
  8. The IDRP Resolution Center will be a new business opportunity for interested firms specializing in Cyber Laws applicable to intermediaries.
  9. By using the expertise available with the IDRP Resolution Centers, the terms can be well drafted not only to include the ITA 2000/8 requirements but also the IPR requirements, the PDPA requirements, the GDPR requirements and other laws that may have impact on the Intermediary-user relationship.

I therefore suggest that this idea can be incorporated in the proposed amendment to the Intermediary guidelines 2018.

(Comments welcome)

Naavi

 

Previous Articles:

Shreya Singhal is Back again!

New Intermediary Guidelines… Legitimate and Well within the rights of the Government: 
Proactive technology tools to identify violation..new intermediary rules: 
New Intermediary Guidelines.. Intermediaries need to have Indian Subsidiaries..: 
Intermediary Guidelines.. Who is and who is not an intermediary?: 
Draft Intermediary Guidelines 2018… Public Comments invited:
Copy of the guidelines: 

P.S: The last date for submission of comments extended upto 31st January 2019. The comments would be put up on the website on 4th February and counter comments accepted upto 14th February 2019… http://meity.gov.in/writereaddata/files/Extention_Guidelines_2018.pdf

Posted in Cyber Law | Tagged , | Leave a comment