Naavi.org

It was heartening to note today that Times of India front news page carried a news of a successful Cyber Crime prevention operation in which Skimming in 5 ATMs were detected before any customer reported a loss. Normally Banks realize that skimmers are placed on their ATMs only after scores of frauds are reported. Some times the skimmers might have even been removed and moved to another ATM before anybody has recognized that a Skimmer was in deed in operation.

We should therefore congratulate Kotak Bank for having identified the skimmer and reported it to the Police quickly.

Once the skimmers were reported, it was perhaps the connectivity that enabled the Police to zero in on the foreigners from Romania who are supposed to have planted them. According to the report the accused came on a tourist Visa and used the age-old practice of fixing the skimmer on the Card slot and a Camera some where to record the Pin entry.

What however surprises most is that in the days of CCTV cameras and ATM guards, how is it possible for some body to walk in, fix the skimmer and the camera, spray paint the edges and go back without being observed. It is simply not possible except when the Bankers are not vigilant and implemented the “Reasonable Security Practices” under Section 43A of ITA 2000/8.

Have the Police filed a case against the Bank?… Obviously no.

Though most Bank frauds occur because of the negligence of the Banks, (It may not be the case with Kotak Bank in this case), Police have always been reluctant to call them to account. This only has encouraged them to continue “Reckless Banking” motivated by the greed for more profits and putting the customers always at risk.

After the Corporation Bank ATM incident, Bangalore Police had sent a mandate that all Banks should provide security guards at the ATM. Banks promptly told RBI that they want to be compensated for the increased cost of such security and started charging money for withdrawals on which today we even pay GST and enrich the Governments both at the center and the state.

Have the Bangalore Police questioned the banks if these ATMs were guarded properly? Whether the CCTVs were functioning? Whether the CCTV footage was being monitored?… We don’t know.

The report goes on to say that thousands of customer data might have been captured and sent out of the country. Had the Police not acted fast, there would have been a catastrophic attack on the Indian Banking system.

What do we all them?… it is called Cyber Terrorism because it strikes terror in the minds of ATM users as a category of our population.

But have the Police booked a case as “Cyber Terrorism”?…. Obviously no.

Police may  look at this case only as an unconfirmed  “Attempt” and since “No Loss” has been reported, it may pass out as a “Petty case of trespass into the ATM area”.

Since the arrests might have been made because the CCTV footage might have caught the suspects, or because the skimmer’s were programmed to send the information to an IP address/Mobile number which was accessed by the accused, the charges that may be pressed may be as some not so serious offences. Also it may not be easy to fix the arrested persons to the satisfaction of the Court to the attempted or successful “unauthorized access” under Section 66 of ITA 2000/8

Since the accused are foreign nationals, going by the way the Italian Marines who were accused of murder in Kerala was handled, these accused will be very soon (if not already) out of jail and moving out of the country.

So, apart from today’s headlines, all the creditable action of the Police may not end up with a lasting deterrence.

Have the Customers filed a case against the Bank for compromising their “Sensitive personal data”? … Again the answer should be a resounding No.

All our Privacy Lawyers are more interested in politically sensitive cases such as when a politician’s  Twitter is hacked  but not when an ordinary Bank customer’s data is compromised because of the negligence of the Bank.

It is of course not practical for an individual Bank customer to file complaints since even when there is some wrongful loss suffered, it is difficult to convince the Police to register an FIR or take up investigation after filing of an FIR. When it is only a loss of “Personal Data”, despite the noise people make on the Supreme Court judgement, there will be no PIL that may be filed … unless this article motivates some public-spirited lawyer in India.

The ITA 2000/8 has made a provision where by when the community interest is adversely affected by a contravention of ITA 2000/8, the Adjudicator of Karnataka can take suo-moto action on behalf of the public.

But, Will the Adjudicator of Karnataka take any action?….. Most probably No

More importantly, the Karnataka Adjudicator (as an office) has to first come out of the false narrative it has built around it that it is not empowered to take up a complaint against a Bank under Section 43 before we can expect it to even consider the suggestion of a suo moto action against banks.

[P.S: Why do I say that the Adjudicator of Karnataka is not interested in coming to the help of the community against a Bank?… and after all, who is the Adjudicator of Karnataka?… I am too tiered of discussing this issue …those interested may search this site for “Adjudicator” and find out.]

In the light of the above, it is now open to senior Police officials like Mr Pratap Reddy, Kishore Chandra and ably assisted by officers like Sharat to take such action which will really leave some long term impact on Cyber Security atleast as it surrounds ATMs.

My brief suggestions in this regard are listed below and is addressed not only to the Police but also to the Banks and RBI.

1. All ATMs should restrict the entry through a biometric lock which collects anonymous biometric information which remains de-identified until it is investigated under a reported crime.
2. All ATMs should be locked and released only after a “Face Recognition” is registered.. again as a de-identified information which also remains de-identified until it comes under investigation for a reported crime.
3. The biometric and face recognition information should be sent to a secure encrypted storage which is not under the control of the Bank..could be under the control of RBI, under  the principles of “Regulated Anonymity” that has been explained serveral times here. The essence of the principle is that the information is held in an encrypted form som where but the decryption and disclosure control  rests not with the collector and user but with a group of controllers. In many of the recent incidents we always have the problem of CCTV footage being erased when the authority responsible for storing the footage itself is a suspect of a crime or negligence.
4. All ATMs should be under the surveillance of a designated Bank official who gets the feed of the ATM room and watches for any irregularity. When the Face recognition camera fails to capture the image, the ATM should not function at all. When the surveillance camera does not function, it should be the responsibility of the officer to lock the ATM until the camera is restored. Emergencies can be handled through the help line requests that are to be diverted to a senior responsible Bank officer.
5. All ATMs should be checked physically for Skimmers, Key Loggers, unauthorized PIN hole cameras, Attempt to disengage the CCTVs etc, unexplained power outages etc so that any attempt to fraud can be quickly identified and reported. The officer in charge should file a mandatory security audit report every day ensuring the “Physical Safety of the ATM”.
6. The current case should be booked under Section 66F of ITA 2008 (Cyber Terrorism) as an attempt to attack a group of Bank customers and thereby destabilize the Indian economy. The arrested persons should be denied bail, passports seized and trial taken up by a special Court for speedy disposal.
7. The Adjudicator also should move a suomoto action against the Bank and fine them a hefty sum which should be set aside as a “Cyber Security Awareness Creation Fund” and used for educating the customers of Banks on Cyber security.
8. CERT-IN should move RBI and the Banks to ensure that sufficient investment is set aside to improve the security of ATMs on the lines suggested above or better.
9. Banks who have not yet acted on the RBI’s limited liability circular should be penalized for deliberate failure to follow regulatory agency’s mandate.
10. All foreigners coming into Bangalore need to be tracked  for identifying potential fraudsters for which our VISA system should be enforced with greater vigilance.

If the Police and  Banks together try to keep a focus on the Bank customer who is the most affected party in this incident, then this success will not end up as a one day news headline point but some thing that will improve the security of the Banking system in India.

Will it happen?….

…Hope is eternal and we continue to hope that atleast a few of the above security measures would be taken up by the relevant agencies.

Naavi

Global Bitcoin prices that had skyrocketed to Us$5000 about 15 days back, has suddenly fallen to around US$3500 now. In Indian currency the rate which struck a high of Rs 353519 has now fallen to around Rs 230000/-.

One of the reasons quoted for this sudden fall is the action taken by China first to ban ICO s (Initial Coin Offerings where pre-mined coins are offered at a price as an investment) and now possibly moving to close the Bitcoin exchanges by end of the month. ( Refer here)

Many investors in India who were fooled by the game being played by the Finance Ministry and invested in Bitcoins must have been caught in this volatility and lost money. In the bargain, some must have also made money. The exchanges would have made their money from both the losing investors and gaining speculators.

These exchanges could have therefore rewarded the officials with hard cash in Indian currencies and perhaps more of bitcoins, for not taking any action to ban Bitcoin and continue to adopt a strange policy called “Observing” .

This is a case fit for CBI investigation of possible corruption by all those who are involved in the decision not to ban Bitcoin all these days and particularly after the public consultation process was launched through MyGov.in and yet no action was initiated allowing the stake holders to spread all sorts of rumours that India is likely to legalize Bitcoins etc.

It is tragic that Mr Jaitely and Mr Modi are turning a blind eye to this scam of “Delaying decision on Bitcoin” engaged in by the Finance Ministry. The situation is similar to decisions that Bureaucrats and politicians engage in when a large tract of real estate property is under consideration for either being “Declared as a Green Zone” or “To be denotified”. The delay in the decision making is a fertile ground to promote speculation and only those who are very very close to the decision makers will make money and every one else lose. This is exactly what is happening now in the decision on “Whether Bitcoin has to be banned, legalized or Observed”?.

We have pointed out earlier that  if Bitcoin is legalized in India there could be a 50% increase in floating currency leading to inflationary pressures of unimaginable magnitude. We had also pointed out that China had a large holding of Bitcoins and could destabilize Indian economy by its manipulations of Bitcoin pricing.

The current indications confirm the control that China exercises on Bitcoin pricing and its ability to move the price easily from around $2000 to $ 5000.

However, one may wonder why China with its own Bitcoin wealth should do anything that reduces the price of Bitcoin.

One reason is that the ICO phenomenon showed how corrupt techie mafia could simply create wealth for themselves using the gullibility of public who are enamoured by the concept of “Regulation Free, Tax Free, Anonymous currency” and jumped into buying anything called a “Crypto Currency”. This could perhaps be the biggest ever financial scam in the Globe. China may not be interested in a Cryptocurrency calamity that brings down the value of all Crypto currencies to “Zero”.

Another point to be noted is that there were many other foolish and perhaps more corrupt regulators around the world who had legalized Bitcoins and allowed for conversion of Bitcoins into legit fiat currencies.

Possibly China would have made use of this opportunity to convert its Bitcoin wealth to Swiss Francs or Japanese yen and may be sitting pretty and would not mind a fall in the value of Bitcoins.

We should also recognize that Bitcoin has been freely converted into many other AltCoins for quite some time and hence the Bitcoin is today indistinguishable from other Altcoins and all Crypto Currencies belong to one large kitty which are part of the global Crypto currency scam.

It will not take much time for the skeletons to tumble down in the international markets and the Crypto currency dream will be shattered.

In that event, even those Banks in India  who might have already got some stake in the Bitcoin holdings could face the adverse effect of this scam affecting to a small extent the Indian Banking industry. Hopefully, this damage will be small and will be off set by the strengthening of the rupee against currencies like Yen and Swiss Franc, Canadian dollars and also perhaps the US dollars due to the larger impact on those currencies with the bursting of the Crypto currency bubble.

As for as India is concerned, the ball has now moved from Mr Arun Jaitely to Mr Narendra Modi himself. RBI has failed to take a decision in-spite of the Supreme Court’s prompting. Finance Ministry officials including SEBI appear to be on the wrong side of the decision.

Mr Arun Jaitely is either sympathetic to Bitcoin or is simply unable to take control of vested interests who are on the side of the Bitcoin Exchanges operating in India.

The last hope now rests with Mr Modi. If Mr Modi does not want to defeat his own Black Money drive allowing conversion of Black money into Bitcoins, he should act now to “Demonetize Crypto Currencies” forthwith. It is already late and any further delay will start throwing shadows on the BJP’s own credibility to root out black money in India.

Hence the question: Dear Mr Modi, Can you see how China can manipulate Bitcoin Wealth?..Why Your Government is blind?

Naavi

P.S: Today, one more article is found at : https://cointelegraph.com/news/indias-central-bank-considering-creating-digital-rupee-dislikes-bitcoin where the possibility of an Indian Crypto is being hinted.

I have already suggested this. However, it should be ensured that no conversion is provided from existing Bitcoins to the official crypto currency if it comes through.

Otherwise, the scam continues.

Further whether it should be an ICO or a real minable crypto currency, needs to be discussed.

As we all know though the first Sec 65B certificate was produced to a Court way back in 2004, it was only after the P.K.Basheer case that the world of law enforcement has taken note of the law as was framed with effect from 17th October 2000. Subsequently, there is a rush to find out the correct form in which the certificate may be given.

I am aware that just as electronic documents were admitted and trials completed before Basheer judgement without Sec 65B certificate, now after the judgement, certificates not in the correct format are being accepted by Courts and trials are going on.

When I tried to quickly look around to see what is the format being used, I find that most advocates simply want to file an “Affidavit” stating that the “hard copies of documents presented are identical to the electronic document” etc.

Two samples of such affidavits one by the party in litigation and the other by the advocate are given below for reference.

Without meaning any disrespect to anybody who may be using such affidavits, I would like to state that this is not the correct form of producing the certificate.

I am sure I have explained in detail the Section 65B certification in many of the earlier articles all of which have been also collated in the articles link at www.ceac.in.

It is necessary for me to make just one additional point here on what I think will be the impact of the advocate submitting the certificate. As in the case of the certificate submitted by the litigant, this will also be a self serving evidence which will start on the back foot from the credibility point of view.

Apart from this, if an advocate stands in the shoes of the certifier, I think  he would be a deemed witness in his own case.

The reason is that the object of the Sec 65B certification is to assist the Court in viewing the binary document readable by a computer device in a more human readable format and to freeze the document as was present at a point of time. Though at the admission stage, the certifier need not necessarily be also a witness on stand, if the certificate is challenged, he may have to stand as a witness and subject himself to a cross examination. At least in the case of the litigant he takes the stand as a plaintiff or a defendant and his views become part of the submission to  the Court. But in the case of the advocate it would be an anomoly.

It is preferable therefore that a trusted third party submits the certificate and his credibility becomes part of the weightage given to the evidence.

Further by design, the above formats of affidavits can be used on an existing print out. But stamping an existing print out  as “Section 65B certified” is not what is envisaged in the section.

I hope these teething troubles will be sorted out in time. However, in all sensitive cases where the evidence is critical, I strongly suggest that litigants and advocates donot take the risk of producing such “Affidavitized Section 65B Certificates” which may be challenged by the opposing parties either immediately during the trial or if necessary again on appeal.

Naavi

P.S: Response to some queries on suggested format, I would like to state as follows:

One standard format fitting all requirements is not possible for Section 65B IEA. It depends on the type of electronic document to be certified.
The first document I certified was in 2004 in the case of Suhas Katti which was a Yahoo e-group message. There could be web pages, face book postings, e-mails, server logs, computer documents, WhatsApp Messages, encrypted blackberry messages, and even audio and video recordings, including CCTV footages. Each requires a different process to be converted into “Computer Output” under section 65B. Just like a Digital Signature, which includes both the person signign and the content he is signing, a Sec 65B certificate includes both the process and the assurances given by the certifier and hence it will be different on a case to case basis except perhaps one paragraph.
Hence kindly donot look for a standard format that can be used in all cases… naavi 

Our honorable Minister of IT Mr Ravi Shankar Prasad has stated that India will create a Global bench mark with its Data Protection Act which is being drafted now.

While we welcome the goal set by the Minister, it is time to discuss how India should approach creating the Global Bench Mark. The proposed Act will be based on the report of the Justice Srikrishna Committee which will actually draft the contours of the Act to which the Government will just add some structure.

Since Justice Srikrishna comes from the judicial background and we are fresh with the 9 member Supreme Court bench decision that “Privacy is a Fundamental Right”, it would be reasonable to speculate that the proposed “Data Protection Act” will operationalize the “Informational Privacy” as discussed in the judgement.

After the judgement, there is already a discussion on whether mobile information is subject to Privacy and whether Police can seize mobiles etc. There is therefore an apprehension that if the law is not properly drafted, there would be serious hindrance on the capability of Police in particular to carry out investigations. Criminals and Suspects will quickly jump to Courts and bring stay and by the time Police are able to get the stay vacated, the electronic evidence might have been irrevocably erased.

The proposed act will note that “Privacy” is equivalent to “Right to Control personal Information in data form” and hence protection of Personal information is the objective of the Data Protection Act.

Will the Act therefore focus only on protecting “Data that contains the personal information”? or will it extend its scope to all types of data including those which constitute say Copyright, Domain Names, Patents?, Will it also extend to corporate information such as financial data, marketing data or HR data? Will it also extend to log records? telephone conversations? …are all matters that this act will perhaps try to address.

This means that the Act should define what is “Data that has to be protected”? and then proceed to classify them into “personal” and “sensitive personal”, “other” etc.

The Act needs to also define who owns “Data” and whether “Data” is a property? and how the Data can be used by who soever owns?

When Data gets aggregated, value gets added and there is always a question whether this value addition belongs to the data subject or the data processor or the data controller who actually instructs the data processor to process the data in a particular manner. Under the Copyright law, the data base administrator gets the copyright on the aggregation part and therefore it recognizes different property rights between the raw data supplier who is the data subject and the entity which adds value which is the data processor or any other entity that uses the raw data .

If Copyright law recognizes copyright on data base creator, then similar principle has to be used in the data protection law also recognizing that the nature of property changes from the data subject to the data processor.

Once we recognize that “Data” is a “Commodity” and different values can be ascribed to it in different stages of its life time, we need to recognize it as a property which can also be traded.

Recently a store in London was reported to be accepting “Personal Data” as payment in exchange for goods. 

The “Data Dollar Store” appears to value the data you present and allow you to trade them. In a way it is a “barter” system . From the initial reports, it appears they may accept some photographs etc as “Personal Data with value”.

Of course if you offer “Digital Money”, perhaps they may not refuse since this also is “Data”… but the concept is interesting particularly for people who can create valuable personal data instances.

Coming back to our discussion on Data Protection Act, there are some practical problems that the authors of the law will encounter. Since the Supreme Court has not really defined “Privacy” but went on a wild discussion on what one eats or where one travels etc is all “Privacy”, the Zomatos and Make My Trips will be dealing with “Privacy Sensitive Information”. If therefore Government makes any law that tells how such companies need to collect information and deal with it, such a law may be questioned as a violation of a Fundamental Right not being saved by the exceptions of national security etc.

We realize that if we take this extreme view, then there can be no e-commerce without some form of personal data being shared with the service provider. Currently, accepted privacy principle is that one can collect personal information as long as it is necessary to provide the service offered and a “Consent” is provided by the data subject in the form of a “Deemed Contract”. The only discussion is on the quality of disclosure and ethics of the collector in collecting only the minimal required information and using it only for the purpose it is required.

But can the Government make a law stating that “The Fundamental Right of Privacy can be infringed by any individual if he has taken a consent in the form of undigitally signed web/mobile based acceptance forming a deemed contract in which the data subject’s rights are agreed to be infringed”. Will it be a “Contract for a consideration that is legally untenable”?

If we take a stand that this is a globally accepted principle and there is nothing wrong in the data subject entering into a contract with another person saying that he can make use of the personal data and he is not pressing his fundamental right, then we are automatically accepting that “Data is a commodity that can be transferred for consideration”.

Will Justice Srikrishna committee be having sufficient courage to say that “Personal Data” is a “Property of the Data Subject” and he can sell it for a price which includes agreement to use the services offered by a service provider?. If they do, then Government will not have any problem with its Aadhaar per-se or mandatory linking of Aadhaar with PAN or mobile number etc.

But If they do, they may be standing against the spirit of the 9 member Supreme Court judgement.

If the Srikrishna committee hesitates and continues to carry over the uncertainty on the definition of Privacy from the Judgement to the committee’s findings, the problem gets transferred to the Meity in drafting the law.

The Government can simply define the law as a “Law to protect the Confidentiality, Integrity and Availability” of Information and make it more as Cyber Security law than anything else. It will of course create the office of the Data Commissioner. It  may also introduce licensing of data processing and other regulations and in the process may make the life of E Commerce entities such as the Zomatos and Make My Trips miserable.

In the end, the law will be an extension of ITA 2008 and will not add much to the domain of “Privacy Protection”.

In all probability, this is what is going to happen and we will continue to keep worrying about the definition of Privacy and  without understanding its nature try to protect it in data form.

Considering the futility of such an exercise, I would like the Government to accept that given the wide definition of “Privacy Right” as ascribed by the Supreme Court, it is not possible to make a law that protects the unknown and omnipresent. 

Instead, the Government may focus on how the Citizens can be compensated when a “Data Breach” occurs and go onto define “Data Breach” and its consequences.

The definition of “Data” can apply to any information in electronic form and “Breach” is defined as any action which is a violation of a contractual agreement.

If we take this approach we need not define what is “Data that is Personal Information”, “Data that is Sensitive personal information” and “Data that is neither a personal information or a sensitive personal information.”.

If the  Supreme Court can use a strategy to define the “Privacy Right” without defining “Privacy”, Government may be able to create a “Data Protection Law” without treading on the difficulty of defining “Data which is Personal information that forms part of the Privacy Rights”.

The existing law in ITA 2000/8 and the rules there under, are sufficient to carry on the market activities since it already provides a definition of personal Information as well as Sensitive personal information in addition to the larger set called “Data”.

The new law can state that any person can enter into a contract with his data as a commodity and bring the data protection requirements under the Indian Contract Act read along with ITA 2000/8.

The new law can also enable and empower any business that may be set up to buy, sell, process or exchange data under a contractual agreement with the data subject or a personal data custodian to whom the data subject has transferred his personal data.

This will define the “Data Trading” concept and provide clarity to companies in Data Analytics and Big Data activities. It will also prevent the IoT industry from being stumped with the new Privacy debate since any information collected by the IoT device is likely to be considered as “Personal Data”. Though IoT data is linked to the device ID, along with the purchase and installation information, it is linked to the personal data of the owner and his location and hence will become a part of the “Privacy Right”. The CCTV captures will also be legally protected if a person walks into a mall and is being photographed by the CCTV system in exchange of the benefit of walking through the premises.

Additionally innovative companies may set up business to de-identify a data set and create value there on before they are actually sold for a profit which they can share with the data subject at the time of re-identification.

Some company may also set up a “Regulated Anonymity” system where it will absorb the identity and provide a proxy ID to the user with which he can do all transactions on the internet. The business can even run an  “Identity Gateway” where the identity such as Aadhaar or PAN etc can be pseudonomized without adversely affecting any service or security requirements of the Government while at the same time protecting the critical identity data from unknown threats.

It is to be recognized however that these intermediaries are still vulnerable to an Equifax type of attack on their systems which could compromise the customer data if they donot implement appropriate security measures.

In such a eco-system, the so called “Data Protection Law” may change its objective from “Protecting Data” to “Protecting the Citizens from  the consequences of a Data Breach” where Data breach is defined as an unauthorized data access in contravention of the data sharing contract.

Such consequences will of course expand on what ITA 2008 now says as “Intermediary Responsibilities”, “Civil Liabilities” and “Cyber Crimes” but with a better implementation mechanism.

The new law can additionally define a system of “Leasing of Personal Data” different from “Selling of Personal Data” to meet temporary requirements. This would automatically incorporate a right some where nearing the “Right to Data Erasure” as referred to in GDPR since data leased cannot be used beyond the lease period. It will automatically terminate the rights of the data processor and shift the onus on him to get the contract renewed much better than the current “Opt-In” system.

The new law can also talk of “Fundamental Duties” of a citizen as a “Data Subject” and uphold his fundamental rights to decide how he can use his personal data including monetizing the personal data as if it is a property that belongs to him. If there after a challenge is mounted on the law in the Supreme Court and it  has to take objection to this law, they have to object to the provision that defines the fundamental duty and fundamental right of a citizen to deal with his own data property. Hence the law may be protected against a legal challenge.

In this context, it would be better to call this law not as “Data Protection Law of India” but as “Data Breach Protection Law of India”.

Naavi

The Equifax Data Breach in USA is considered one of the most severe data breach of all times. For records, it is said that the largest data breach in terms of records compromised was Yahoo data breach with 1 billion compromises and the next was MySpace data breach involving 360 million accounts. But the nature of data that has been compromised in Equifax incident makes it the most severe in terms of the consequences.

Equifax has admitted a breach to the extent of 143 million accounts of US citizens and there could be more in UK and Canada. It is therefore the third biggest in terms of data breach numbers and could climb higher.

Equifax is a credit rating company and holds records of not only its direct customers but also other members of the public who might have never directly interacted with and given consent for sharing any of their personal or sensitive personal information. The 143 million number may reflect its client base and actual data breach in terms of numbers could be far higher.

The type of information that Equifax held in respect of different persons could vary from personal information such as Name birth dates, addresses, Social Security Numbers, Driving license numbers etc. Being a credit monitoring company, Equifax collected vast amount of financial information from consumers without their knowledge. Associated information such as the Credit card data is also suspected to have been compromised in thousands of cases.

In the light of the information available in public we can look at what lessons we can draw in India from this data breach.

CIBIL is under similar Risk

The Indian equivalent of Equifax is “CIBIL” and similar agencies like Experian India, Credit mantri. According to Bankbazaar.com, equifax also operates in India. We should brace ourselves for a similar breach in India where the sensitive information with CIBIL may one day be breached.

In India credit rating agencies initially started with CRISIL and CARE which focussed on rating of Corporate securities and Fixed Deposits of NBFCs. CRISIL and CARE learnt their trade by experimenting their credit rating systems against the NBFC industry in India and can be historically held accountable for  one of the worst financial disasters in India with the failure of CRB capital Markets and subsequent developments that caused an upheaval in the NBFC market.

The undersigned was one of the early proponents of personal credit rating mechanism but at that time, only First Leasing Ltd headed by Mr Farouk Irani was speaking of Personal Credit rating. It is a tragedy that today Mr Farouk Irani is in deep trouble and under ED investigation but the fact that he was one of the early thought leaders in the field of Personal Credit Rating in India has to be acknowledged. The undersigned was however trying to convince the Shriram Group with a wide spread presence in the personal lending sector through their “Chit Funds” to enter the field of Personal Credit Rating but could not succeed. After nearly 15 years, we are now into the era of the foreign Credit rating agencies including Equifax.

There are a few of this new generation agencies which profess to make credit assessments through social media activities of individuals and in the process collect large volumes of personal data. CIBIL is a little more civilized since it directly collects data from the Banks and lenders under the RBI patronage and hence need not scan the social media for information. The accuracy of data with CIBIL is debatable but it is perhaps still a good reference point for most lenders.

Going by the history of how Indian Credit rating agencies have developed,  it is not unrealistic to expect that CIBIL data is today accessible through hundreds of service providers and not all of them will be as secure as they should be and hence the possibility of data breach from Indian credit rating agencies is very much possible. Just as Aadhaar data was easily accessible through many e-hospital portals, CIBIL data is accessible through many Apps and portals which can be compromised by hackers to extract sensitive data. Hence a repeat of Equifax incident in India with CIBIL can be expected. It will at least be a “Risk” that CIBIL needs to patch.

One of the mistakes that we are making in India is to create an integrated frame of data reference through Aadhaar and PAN as well as UPI and GST. These strategies have resulted in a single interface which if breached can expose a billion data sets. Had the data been distributed some on aadhaar number, some on PAN number and some on Bank account numbers etc, then breaches would have been contained in individual silos. Government in a bid to manage the information, has used a strategy to integrate all sensitive data using a single user ID such as Aadhaar instead of silently working behind the scenes to integrate the data bases in the back end.

This wrong strategy has created a higher risk and a greater incentive for hackers

Privacy Risk back in debate

The Equifax data breach has indicated that in such cases, the sensitive personal information gets leaked from agencies which were never given a consent to collect such information in the first place. In the context of the debate on “Privacy is a Fundamental Right” it is a moot point how CIBIL’s activities may be questioned in the coming days in India.

Inadequacy of Cyber Insurance

The Equifax incident also throws up the inadequacy of Cyber Insurance for such organizations since the cost of the breach such as providing notices to 143 million persons, providing free credit monitoring to persons who have lost credit card information and suffered consequences of identity theft with the compromise of social security numbers etc will run to a billion of dollars as against the US $ 100-150 million dollar insurance that the company now holds.

Insider Trading possibility

The share prices of the company has come down by 14% after the incident and one need not be surprised if the company folds up and goes bankrupt. It is interesting to note that some of the executives of the Company are reported to have sold large chunks of shares just before the breach which indicates a possible insider trading. This could also indicate internal dissensions that could have led to the breach though for records Equifax attributes the breach to some vulnerabilities in the “Open source Struts Software distributed by the non profit Apache Software Foundation”.

We all know that in all cases of data breach there is a gap between the recognition of data breach within the Company and its confirmation and disclosure. If the company is a listed company, during this period many persons within the company will have sensitive corporate information that has not been reported to the stock exchange and hence constitutes a breach of stock market obligations.

At the same time if the executives start trading on the stock markets, it will constitute insider trading.

It is therefore essential that under the Information Security policy, a listed company should mandate that no member of the internal team who is aware of the breach shall trade the shares in the market.

Equifax Response

It is also interesting to note how Equifax has responded to the incident through their website which is an indication to Indian Companies who often flounder when faced with major PR disasters.

Equifax.com now redirects to the personal section where a prominent mention has been made

on the incident and a redirection is provided to a new site equifaxsecurity2017.com

In this website full details of the developments are provided and this forms a public disclosure of the breach incident. It also provides for checking the potential impact against a social security number.

At this point of time we are not aware how Equifax is addressing the possible breach of persons who are outside USA. It is also now known if their data has also been breached.

The equifax breach affecting the social security numbers through a user organization is exactly what we in India have faced and will continue to face regarding the breach of Aadhaar data in India.

The reality is that when you allow data to be used by a number of users (Data really exists for this purpose and this cannot be avoided) and they can also store the data extracted from a central source, we cannot always ensure that the security cannot be breached at the user’s end where the data from the central source is stored. Most of the time The leaked data cannot be distinguished as to the source of the leak and hence the central data base has to face the public spat.

Since the media persons donot understand the intricacies of data usage, they always blame wrong persons for the breach and Police tend to follow the media trial. In the process citizens always get incomplete and inaccurate information of the incident and its impact.

Data Protection Act

The problem with the Aadhaar data base in India is that it is linked to the biometrics and hence once the data is leaked, the privacy value of the data is lost for ever. Even in the USA, with the leak of the social security numbers associated with the equifax set of data,  when used with other biometric data bases could mean permanent loss of Privacy for all the affected victims.

Under the present circumstances all around the world where “Privacy” is linked to “Personal Information” stored by millions of intermediaries and the possibility of large scale data breaches, it is futile to believe that “Right to Privacy as Right to control how the personal information in data form is to be used” really exists.

The Government of India is now trying to form a “Data Protection Act” and the Minister aims at meeting global standards of data protection in India through this Act. But if the global standards of data protection is indicated by what happened in Equifax, it is clear that we are chasing  a dream that cannot be fulfilled.

It is better that both the Government and the Supreme Court realizes that “Data Protection” is a good faith, best effort and the focus cannot be on “Data has to be protected in such a manner that it cannot be breached”.

On the other hand if we focus on “Data Trading” as a concept and declare “Data as a Property” which the individuals can trade, at least we will not be misleading the public that “Data Protection” and “Privacy Protection through Data Protection” can be implemented in India to the extent they believe it should be.

Once this concept of “Data Trading” is accepted in law, we may be able to legitimize “Data Pseudonomization” as a business proposition and the concept of “Regulated Anonymity” can actually be put in practice.

At present, the Srikrishna Panel on data protection is unlikely to be considering any such proposal and hence the Data Protection Act which will follow may miss an opportunity to pursue realistic data protection regime in India.

In our opinion, there is no practical use in simply repeating the words

“Privacy is a Fundamental Right and Personal Data Protection is a constitutional obligation of the Government” which should be translated into a Data Protection Law”

Instead of beating round the bush we must accept that Data cannot be protected for ever and we need to plan the data protection act with a declaration in the preamble that

“Data Protection is a journey in which the goal will never be reached and hence the law aims at providing only a framework for responsible data sharing with the consent of the data subjects and providing for legal remedies for breach”.

The law may therefore in effect not be a “Data Protection Act” but a “Data Breach Act” or “Data Breach Protection Act” whatever may the title assigned. It should incorporate all the lessons that Equifax teaches us along with other similar experiences.

Any other expectation is hypocrisy.

Naavi

Related Articles:

Reuters-Sept 8:

Indian Credit Rating Agencies

Equifax is in India

What Equifax says on September 8

As we wake up today to the news that two boys in Bangalore were detected to have been playing Blue whale challenge “game”, the threat seems to be spreading fast. Bangalore is reported to be the sixth city in the world to have searched most for Blue Whale on the Google.

Some have suggested that the increased media attention on Blue whale is actually making more people take up the game. However today’s incident indicates that friends in a school observed and reported to their teachers about the two boys suspected to have been playing the game and the matter then has been reported to the Police and further action has been taken.

This clearly indicates that “Awareness” has actually saved these two persons from proceeding further and vindicates the strategy of containing the damage suggested in the earlier article…. The Blue Whale Challenge.. Where is the Effective Action Point for Control? 

Can Courts find a solution?

Following the many reported incidents, there has been a tendency to file PIL in Courts and seeking a judicial remedy to the problem. Even the Central Government has swung into action issuing instructions to Google and Face Book to block access to Blue Whale Challenge game. A lot has been written about how parents, schools and Internet intermediaries need to do etc.

I have also previously discussed the nature of the threat in the article… The Psychology behind Blue Whale Challenge which Claims one life in India… which may also be referred to now.

We must understand that Blue Whale Challenge threat is not like a typical Cyber Security threat which can be addressed by traditional Information Security solutions such as “Firewalls” and “Anti Virus”.

This is a threat that arises out of “Internet/Mobile Addiction” in the first place and “Blind Faith in Virtual Content” in the second place.

Unless we address these two sub threats, we will not be able to make progress in mitigating the risk of Blue Whale. There is no doubt that all stake holders namely the Parents, School, the Intermediaries and the Government have a role in addressing this issue but it is necessary for all of us to appreciate the root causes before jumping into solutions.

De-addiction to Internet/Gaming/Mobile

The first task in mitigating the Bluewhale challenge is trying to address the “De-addiction” requirement of a subject from adverse effect of addiction to Internet or Gaming or Mobile. Gaming addiction is more dangerous than Internet addiction and Mobile Gaming addiction is even more dangerous.

Identification of “Addictive Behavioural Pattern” can be done by the parents since they have an opportunity to observe the children’s behaviour to some extent. However, we must also recognize that in  most homes today, children enjoy a high level of privacy and it is not possible for parents to always be aware of what their children are doing. In fact, many parents would be happy if children leave them free to watch TV serials and lock themselves up in their study rooms. Some parents are too busy with their official work including attending to calls at odd hours etc and cannot spare time to watch and interact with children.

We also understand that the case in Madurai as well as two cases in Bangalore are of children in the age group of 18 and 19 who are actually “Adults”. Our Supreme Court feels that “Privacy” is a fundamental right and therefore if any Parent tries to intrude into the Privacy of the Children’s mobile, then they need to face challenges from their children that their privacy is being intruded.

There are some technical solutions which are essentially spywares that the parents can install in the children’s mobiles and they would be tempted to do so. However, this is not recommended and is considered counter productive.

Blue Whale is a game which starts with a compromise of the device and the Curator takes full control of the mobile from the very beginning. Hence even if the child does not identify the spyware presence, the Curator would find out and may warn the child that the Parent is spying on them and also use it as a tool to prove that “Parents are not to be trusted”.

Even Courts are today confused as to how to deal with a complaint about any content in the mobile and whether its access would be a violation of Privacy.

I would like to state that since “Privacy” is still a right that can be over ridden for interests such as “Security” and also “A person who is psychologically under the control of the curator..or suspected to be so” can be considered as “Mentally not in control of himself”, Parents or Teachers who try to find out the contents of a mobile of the Child for checking on the Bluewhale threat cannot be said to be infringing on the Privacy.

Schools may display a notice to this effect in their premises, confiscate and check the mobiles of students if need be and if this is objected to and challenged in a Court we should fight until a 11 member Supreme Court bench clarifies the limitations of the right to privacy.

Legally speaking, if the mobile has been purchased by the parent and he/she hands over the mobile to the child with a specific indication that it is on lease to him/her and the parent retains the right to observe and monitor the use of the device including inspection of the content, no Court should be able to interfere on Privacy grounds even if the child is an “Adult”.

Despite this support of the parental rights to spy on the children’s mobile habits, I would like to make it clear that I do not recommend it from the point of view of maintaining the harmonious relationship between the parent and child.

Hence I consider that the Parents role would be only to identify the “Addiction Behaviour”. There are three important parameters for this which I have highlighted earlier namely

a) Immersive tendencies... forgetting the time when on mobile

b) Substitution tendencies... replacing physical activities with mobile activities

c) Irritable tendencies…. getting angry when brought out of the mobile world

If it is confirmed that the child addictive, expert help need to be sought for counselling for which the School is in a better position to administer.

At the Schools, apart from building awareness, there is a need to

a) Make an Internet Counsellor available for consultation

b) Initiate a whistle blowing program so that friends can identify the Bluewhale hooked children and report it to the management.

If Courts and Government wants to provide direction, they should focus on mandating the appointment of Internet Counsellors who are child psychology specialists with an understanding of Internet and game addiction problems.

“Internet De-addiction” and “Game-De-addiction” programs should be a focussed activity in Schools to mitigate the Bluewhale challenge risk.

Breaking the Blind Faith

The next mitigation effort is to break the blind faith that the addicted persons exhibits on anything which is on the Internet.

We often train small children going to school that “they should not trust strangers”.  This has been mostly successful and children are today conditions to distrust strangers.

Now we need to reinforce this instruction and make children understand that they should not trust strangers on the Internet who come as “Friends” in Face Book or Whats App or SnapChat.

I consider that this is the single most important thing we need to do in the wake of the Bluewhale havoc.

Unfortunately we all have contributed to the conditioning of the Children into thinking that “Google” or “Wikipedia” is the “Most Trusted information source” on anything on earth. Most times this is true.

But we are already aware that if a pop up appears stating “Your Computer is Infected”,  we now know that we should not trust this.

Also, if we get an e-mail “Your Mobile/E Mail has won 1 Million US dollar prize”, we know we need to ignore.

When we receive an e-mail from a Bank stating that “You need to update your security information” or a phone call stating “Your Credit Card needs to be replaced” or “Bonus is payable to you on your insurance Policy” or “Income tax refund is due to you…” , “I am in London and have lost my passport..please send me money urgently“, “I am a Nigerian Prince and want your help to stash away a few billion dollars”…etc…etc we know not to believe it.

Similarly, if some body comes on line and says “I am your friend”, we should let our Children suspect if this is a genuine “Friend” or a “criminal in the garb of a friend”.

We know how the 13 year old Megan Meir was cheated by a mother of a classmate who impersonated as a 16 year old ” Cute Boy” eventually leading to the suicide of the girl.

We also know how a software professional in Canada was fooled by a middle aged lady in Coimbatore into believing that he was chatting with a beautiful young girl ready to marry him but being kept under house confinement by her parents and extracted over Rs 3 lakh worth gifts from him.

We also know how a Gujarat Ambuja Cements Executive committed a fraud of over 2 crores making a person in Dubai believe that he is actually a “She” who had fallen in love with the victim,  committed suicide since he rejected her and Police are on the look out for him to be arrested…etc

Today it is our responsibility to teach our young children that Internet is full of such “Impersonation” and “Cheating through Impersonation” and  when some body appears on Facebook chat and says, you seem to be depressed, you can chat with me as a well wisher….we need to be on our guard.

We need to condition our young brains that when we interact on the Internet with strangers, we donot even know if he is a man or a woman, boy or girl, a pedophile or a scamster and hence we need to distrust him from the go.

Internet has so many good things and we the Parents and Schools are ourselves responsible for introducing the addictive tendencies in our children.

Very early in the life of a toddler, parents start showing Mobile and playing you tube videos of Nursery rhymes as the child keeps staring at the wonderful video that plays with colour and sound. A little later we enjoy our children playing games on the mobile trying to shoot down bad people or strike down an opponent with a Taekwando kick. Through out the growing period of the child in the pre-schooling days and later, the child is observing that his parents are always on the mobile …may be for official business… of for WhatsApp chatting… and looks at a Mobile as a “Toy of the Grown Up”.

When the child moves to the school, teachers say… Go to Internet and find out from Wikipedia…. Baiju advertisement says… learn through your mobile… Friends say if you want o know the meaning of a word, check with Google…and not dictionary… and so on.

With all these behavioural traits exhibited around us the child grows up picking up the addiction along with the blind faith on the contents on the way.

Just as a child who growing up seeing people all around him smoking, drinking and partying getting addicted to such habits, a child growing up in an environment where every body including his teachers look to Internet for guidance makes him believe that what is said on the virtual world is “Truth”. If “Siri” says traffic is heavy on a road and you need to take diversion, the child is conditioned to believe it. If somebody says he/she is actually Siri and chatting with him/her on the Facebook to relieve of his depression and parental neglect, it is natural that he will believe and go behind this “Virtual Fake Siri” like going behind the pied piper.

Thus “Mobile Addiction” and “Blind Faith in virtual content” is what we have taught our youngsters. The Curators of Blue Whale are now exploiting this “Conditioned Mind” and using “Cyber Hypnotism” to take control of the vulnerable kids.

Cyber Hypnotism

“Hypnotism” requires a “Communication” between the hypnotizer and the subject. In a physical world, we try to make the subject relax and listen intently to our suggestions until he falls into a trans, establishes a private communication network with the hypnotizer and starts taking suggestions directly into his sub-concious mind. The hypnotizer is also able to leave “Post hypnotic suggestions” which could change the attitude and behaviour of subjects even after they come out of trans.

Now look at the medium of Internet and the face book chat. The subject is all alone, staring at the computer screen ready to listen (through ear phones some times) intently and without disturbance to the voice coming from the other side or see the words and picures appearing on the screen. For a seasoned hypnotizer, this is an ideal condition under which he can get the subject into a trans at a snap of his fingers. The role of “Horror movies” used by Bluewhale curators is a way of softening up the subject so that he starts losing his self confidence and moves from a depressed state to depressed cum fearful state in which suggestions are accepted readily.

If there is any resistance, the hacker will use the information he has got on the subject which he has gathered by planting a trojan and through his research on face book status etc., to make the subject believe…. “I Know everything about you and your dear ones around you… I Can harm them if I want…just like what you have seen in horror movies…”.

If the subject is already depressed, the curator may reinforce the depressed feeling… you are right to be depressed…continue…be more depressed…until you feel that you donot deserve to live…

There is one belief under which all hypnotists work. It was that under hypnosis you cannot over ride certain basic attitudinal beliefs since the natural resistance mechanism will come to defend the individual. For example, you cannot make an ordinary person to commit a murder when he is a trans. The Blue Whale is challenging this basic principle since it is successful in driving the subject to even committing suicide.

We need to either give up this myth or find a new logic on the conditions under which a hypnotic subject may be made to work against his fundamental beliefs.

We may remember that the last act of “Suicide” for a subject who completely believes that he is a life not worth living, is actually a feeling of “Success”. He is perhaps made to believe that though I have failed all through my life, I am recording at least one successful act in life of jumping down this high building and taking away my life.

Possibly, the conventional “Anti hypnotic resistance” is over come because of this “Feeling of Success”.

Under psychological analysis, it is difficult not to appreciate the ingenuity of the Game and it is no wonder it was created by a psychology student. Just as Technologists are enamored by the Bitcoin and Block Chain, psychologists and hypnotic practitioners may get enamored by the game as it teaches them how to mesmerize and hypnotize through the Cyber Medium without the need to dangle a pendulum before a subject relaxing in an easy chair in a room with a dull read light.

We should not therefore fall into a false sense of security by the Government asking for non existent links to the games to be removed. If at all Google or Facebook has to be of help, they should be able to use “Artificial Intelligence” to  pre-identify vulnerable victims and monitor their chats. If successful they may be able to identify “Suggested hyper links in Chat conversations” and filter them against known darkweb addresses, horror movies etc.

If Courts want to be of help, they can first direct Schools to put in place an infrastructure for identifying potential victims and administering counselling.

Schools Calling the Police is not necessarily a nice thing as Police are not equipped to handle the psychological issues of children and in fact make children feel more afraid and guilty with a feeling of shame.

If Courts and the Government can persuade Facebook and Google to monitor Chats to identify potential victims, they can do so. But herein comes the catch… Are they going to be guilty of “Privacy Invasion”?

We need to ask the Nine honourable Judges who passed the dictum “Privacy is a Fundamental Right” to let us know if monitoring the chats of vulnerable children would be allowed?… by the Parents?…by the Teachers?….By the Police?…..By the Intermediaries?….By the Government?…

…..perhaps we need an 11 member Supreme Court bench to decide on this.

We can also look at some technical solutions at ISP level where ISPs may be allowed to run filters against specific devices..termed “Restricted Access” where Parents will be allowed to restrict access to Internet or Gaming on a selective basis in their children’s mobiles because they own the device and the internet subscription.

Here again, the Supreme Court may come down and say we are depriving some other fundamental right such as  “Freedom of Speech”, “Freedom to go anywhere on the cyber space”, “Freedom to browse through dark net”, “Freedom to play any game we want”, “Freedom to chose our entertainment source” etc….

The decisions in the case of both Section 66A and Privacy shows that we need our Judiciary to understand how good things like “Rights” have to be peppered with “Responsibilities” and “Duties”. It is not enough if Indian Judiciary is appreciated in foreign press as “Most Mature to uphold democratic principles”. It has to also understand that all Rights come with the need to manage the security of the environment. This applies as much to freedom of speech of Kashmiri Militants as the use of technology by psychopaths like the creators of Blue Whale.

Naavi

Related Articles:

Incident in Madurai ::Incident in Pondicherry

What Parents can do:: What schools can do :: What Facebook etc can do

What is Bluewhale?

P.S: Here is an interesting photograph where if you keep your eyes half closed, you see a smiling girl. If you open your eyes wide open, you see a devil like face. It depicts Blue whale game and other addictive games appropriately. Let’s look at Blue Whale challenge with our eyes wide open.