Naavi.org

Phishers and Scammers look out for every opportunity to fool gullible people by sending out messages which appear to come from some well known companies or entities.

The objective of such hoax messages may be

a) Just spam for fun

b) Spam so that the ISPs benefit with better bandwidth usage, say by asking people to spread the message through WhatsApp

c) Collect information about users

d) Make users click on malicious links and implant trojans for committing further frauds ..etc

One such message surfaced today on a Whats App group with the following message.

Quote:

Good News For Jio Users

Activate Jio Sim Unlimited Data with EXTRA 1 YEAR Validity FREE with unlimited 4G till DECEMBER 2017 Click here to Activate Now
? www.jioupgrade.com

Share with your friends and groups so They also can get extra 1 year Free . Thanks friends !

Unquote:

Obviously, the message is well timed to attract the users who might have missed the Jio Offers lapsing on March 31st.

However, this message appeared to be a fraudulent message aimed at attracting users to share their telephone numbers with the website.

The website is mirrored from “jiosim-extra-1year.ml/ by HTTrack Website Copier/3.x [XR&CO’2014]” .

The website is registered in the name of naman.arora21134@gmail.com, with telephone number 9876543210, with a vague address, “Jio upgrade, 5th Hyderabad, 500013”

It is interesting to note that the site resolves to a https address which makes some believe that this is a genuine secure website.

.ml refers to Mali and it appears that jiosim-extra-1year.ml has been registered by some fraud syndicate which runs a service to mirror another website and run it along with Google Ad scripts to generate ad revenue. Obviously, it can also be used to commit phishing attacks and DDOS attacks. The identity of the owners of this website with .ml extension is being guarded by the service providers and in my view are considered part of the fraud syndicate.

The exact benefit this naman.arora21134@gmail.com would like to derive from this fraudulent spamming is yet to be ascertained. I request security experts to check the source code on the page available here 

At first glance it appears to be an attempt to steal the telephone numbers, E Mail address and internet access details of the person responding to this invitation. I suppose this will later be exploited for further spamming through SMS /Email messages and possibly with malicious code injections.

If both the email address and mobile numbers are registered for banking transactions, we must be alive to the possibility that the spammer may get opportunities to inject malware to commit financial frauds by taking over the Bank account.

At this point of time, there is sufficient indication to believe that several offences under ITA 2000/8 have been committed primarily by naman.arora21134@gmail.com whose real identity can be obtained from Google along with his bank details to which the ad revenues are being programmed to be credited.

Hyderabad police needs to act and they also have a mobile number to start their investigation apart from the gmail address and Google Analytics ID.

Jio also should file a complaint as this is an impersonation and an offence under Section 66C ad 66D of ITA 2000/8. If Jio ignores the impersonation, any affected party may claim the damages that he may suffer from Jio for not exercising due diligence even after it was brought to their notice through this public blog post.

I wish Hyderabad police start their investigation without waiting for Jio to file its complaint or even register a complaint for enquiry and send notice to Jio why action should not be taken against Jio for not taking efforts to prevent such impersonation through public notices.

I agree that there are many such frauds but the beneficiaries of such fraud such as the intermediary hosting organizations, domain name registrars etc must be made answerable. Without pulling up such intermediaries and make them exercise caution before registering fraudulent website names, internet frauds cannot be checked.

I request receivers of this email to ignore the message and not circulate the message further.

Naavi

CyAT was established to settle the appeal regarding civil disputes between an IT User and any person who might have caused a wrongful loss to him which is adjudicated by an adjudicator or the CCA. Essentially the disputes involved a “Cyber Crime” leading to a loss of money.

TDSAT on the other hand was established to settle the disputes between the Telecom service providers and  between the Service provider and the Government. As regards the consumers the Act provided only for  disputes between a “Group of Consumers” and the service providers.

In other words, TDSAT did not envisage dealing directly with the Consumers. The consumer disputes were outside the jurisdiction of the TDSAT.

The work of the TDSAT also does not involve evaluation of any crime.

The qualification criteria for the post of the Chair person of CyAT was that the person should have been eligible to be appointed as a Judge of a High Court. The Criteria for TDSAT is that he has been a Judge of a Supreme Court or a Chief Justice of a High Court.

It is therefore evident that the cadre of the Chair person of TDSAT is a few notches above that of the CyAT.

The appeal from the CyAT was to the High Court of the appropriate jurisdiction namely the State from which the adjudication was referred to. In the case of TDSAT, the appeal goes to the Supreme Court.

Hence the High Court has been completely taken out of the equation in case of Cyber Crime related civil disputes.

If one takes a look at the type of disputes that are there in the two tribunals, disputes at TDSAT are big ticket disputes while the CyAT disputes are small ticket disputes.

However the nature of disputes are completely different. While the TDSAT disputes are more contractual disputes, CyAT disputes revolve around nuances of Technology law and its interpretation. Though small in value, CyAT disputes are perhaps as complicated if not more as the TDSAT disputes.

Expertise required for resolving CyAT disputes is different from the expertise required for resolving TDSAT disputes.

We can therefore consider that the culture presently built up in TDSAT both by the bench as well as the administration will be alien to the culture of the CyAT.

This will reflected in all aspects of interaction between the CyAT parties and TDSAT. It could result in higher fees, more rigid implementation of procedural documentation,  (such as how many copies are to be filed, whether the copies should be bound in a particular manner, whether the pages are in legal paper size,whether the applications are to be affixed with stamps, notorized), etc. The emphasis may be more on the adherence to the procedures and individual who would like to appear in person will find it difficult not to annoy the senior Supreme Court judges who will handle the bench.

It is likely to be intimidating to the ordinary members of the public to represent themselves before TDSAT when compared to CyAT.

Given the low ticket value of the disputes, there is also the danger of CyAT cases getting a step motherly treatment in terms of listing and other priorities.

At this point of time, these are apprehensions and I wish they remain apprehensions. But given the unfortunate precedence where some of my unpleasant predictions have become true, I am keeping my fingers crossed and wish my apprehensions remain as such and don’t turn out to be the reality.

We will have a better reflection of what will happen when the rules for CyAT cases to be handled by TDSAT are formulated. We will wait for that.

However, experts in traditional jurisprudence and Constitution may reflect whether between the “Enquiry” of the “Adjudicator” to the “Supreme Court” only one judicial process of the TDSAT would be considered a good judicial practice and whether this is a wise way of structuring the Cyber judicial system in proper hierarchical steps. It is like jumping from the Magistrate’s Court to Supreme Court in one single step.

Though the TDSAT has the powers to define its own procedures which can make it  less complicated than the Civil Procedure Code, unless TDSAT starts a “Roving Bench” for CyAT cases where the bench sits in different State Capitals as a matter of routine and also makes provisions for “Online Hearings”, TDSAT will be considered as less people friendly than CyAT.

I feel that Mr Jaitely and his team has erred on this aspect of looking for the perspective of the litigants,  just chasing cost reduction or to cover up their inability to find a Chair Person for CyAT.

While I still wish some sense will return to those who drafted this amendment and they would drop this idea of merger and instead focus on finding a suitable Chair Person for CyAT as it exists, the possibility that this will be cry in the wilderness is very high.

If unfortunately the merger proposition goes through, I call upon the TDSAT Chair person to work with the MeiTY and the current CyAT Registrar to form a sub committee to draft the rules regarding how the CyAT disputes will be handled by TDSAT.

I also call upon the Government and TDSAT Chairperson to seriously explore means of creating a “Sub-Bench” exclusively for CyAT which holds sittings in State Capitals in frequent intervals and allows Online interaction and introduce other measures including a lower filing fees and formalities in conducting of the hearings.

Naavi

The Government of India has moved an amendment to the Finance Bill 2017 in which it is proposed that the Cyber Appellate Tribunal (CyAT) constituted under Section 48 of Information Technology Act 2000/8 would be merged with Telecom Disputes Settlement & Appellate Tribunal (TDSAT) constituted under Section 14 of the TRAI Act.

The CyAT had not been functioning since June 2011 after the then acting Chair Person Mr Rajesh Tandon attained super annuation and the then prevailing UPA Government in which Mr Kapil Sibal as the Minister of IT did not see eye to eye with the Chief Justice of India to find a substitute.

It must be noted for the sake of history that the appointment of the Chair Person of CyAT became a battle of prestige between the UPA Government and CJI and continued even after the Modi Government took over. Mr Ravishankar Prasad was unable to sort out the differences with CJI since this Government was caught in the NJAI dispute with the Judiciary. This was a bigger  battle between the Judiciary and the Legislature and there was no agreement on the appointment.

It was a matter of shame for Mr Modi’s Government that even after coming to power in 2014, until now they were not able to appoint a Chair Person to CyAT and make it functional.

Naavi.org has been vocal in its views on this matter and how the Cyber Crime victims have been put to unjustified harassment because of the failure of the successive Governments as also the honourable Supreme Court in settling their inter-se disputes and consequentially holding the Cyber Crime victims to ransom. (See past articles here)

Now the honourable Minister of Finance, Mr Arun Jaitely who is also the defacto second in command in the Modi Government, seems to have come up with what he may consider as a “Master Stroke” and proposed a merger of CyAT with TDSAT.

The principle adopted here is:

“If we cannot find a Chair Person, then the solution is to simply abolish the Tribunal”… “It is as simple as trying to cure cold by cutting off the nose”

Advisors to Mr Jaitely might have felt that it may make political sense also since we already have a Tribunal called TDSAT (where fortunately there is a functioning body) we can hide CyAT under TDSAT and no body will know the difference. Hence this grand idea.

In order to avoid any discussion about the proposal, the amendment has been brought to the Finance Bill so that the proposal will sail through the Parliament. Most MPs except perhaps Mr Rajeev Chandrashekar would not understand the implications and the Government can claim credit that they have solved the problem of CyAT which was in existence since 2011.

I will not be surprised if the equally ignorant Media persons also hail this as a great development to control the raising incidence of Cyber Crimes in the country such as the Card data breach of State Bank of India and other Banks. There will be Delhi based legal experts who will endorse the decision or oppose it based on their political affiliations without addressing the real issues of the public.

But, the undersigned would like to go on record to state that this move to merge CyAT with TDSAT is not a wise move. It is a knee jerk reaction and not well thought out. It is anti-consumer and will make justice in-accessible to the Cyber Crime victims.

I am aware that Mr Jaitely will not change his decision now and Mr Modi will not know the real impact of this decision. So the decision is a fait accompli.

What is now left for Cyber Law Activists is to focus on the rules and regulations that need to be notified for the activities of TDSAT related to the CyAT and salavge some consumer orientation in the rules.

This is unlikely to happen in a hurry but is the only opportunity to ensure that the merger move does not permanently damage the Cyber Judicial structure in the country envisaged by ITA2000/8 and set the country back in terms of Human Rights and Ease of Doing business.

It must be also noted that the Finance Ministry headed by Mr Jaitely could not force RBI to operationalize the August 11, 2016 draft circular on Limited Liability for Customers in Bank frauds because the Bankers could bring their influence on the RBI. Now it is the same Banking lobby who are behind this move to put a hurdle on Bank Fraud victims who have been knocking the doors of CyAT for relief.

I wish Mr Jaitely takes these accusations seriously and takes some corrective measures as I presume that the decision is not based on proper understanding of the problems involved and otherwise the intentions of the Government are noble.

I have already sent a brief personal appeal to Mr Jaitely as well as TDSAT on the expectations of Cyber Crime victims though I am not sure it will be responded to.

I will expand my views on my concerns in these columns and request other Cyber Law Specialists to contribute their views so that damage to the Cyber Crime victims of India can be limited.

Naavi

Related Article:

Congress Questions the move...

Bitcoins are internationally exchangeable into foreign currency of different countries and to some extent even in India. Hence at a time when the Government may be trying to force foreign Governments to share information on Benami Bank accounts in foreign Banks, it is natural that Bitcoin appears to be a good commodity to hold black money.

The recent raise in exchange rate of  Bitcoins indicates such a the possibility that black money owners are migrating from other assets to Bitcoins. It is interesting to note that between November 8, 2016 when demonetization was announced and today, Bitcoin has appreciated from around $713 to $1155. This price movement is an international price movement and cannot entirely be attributed to Indian Black Money Diversion. However the possibility that Indian Blackmoney might have contributed to this cannot be ruled out.

RBI after its initial knee jerk crackdown on Bitcoin has softened its stand now and appears to be reluctant to take any action that is negative to the Bitcoin industry. At the same time, the technology behind Bitcoin namely the “Block Chain Technology” is often spoken about by official banking circles as a technology that can be used in the Banking industry. ICICI Bank even claims to have tried it out in some form.

It is however necessary for us to clearly distinguish between Bitcoin as an existing Crypto Currency and the “Block Chain Technology”. The official response should take cognizance of this distinction and accordingly RBI and the Finance Ministry needs to formulate appropriate policies before things get complicated.

Naavi has been advocating that India can consider starting its own Crypto Currency under the regulation of RBI itself where every Crypto Currency mined under this scheme will have the stamp of RBI and a record at RBI. This would be a useful “Digital Currency” to support our digital initiatives.

On the other hand, allowing Bitcoin to gain currency may not be a wise move since it is not a “Currency” in the traditional sense and as a “Commodity” it carries the baggage of being a currency of the underworld.

Legally, Bitcoin which is freshly mined in India is a valid electronic asset and can be exported for a clean profit. Similarly, buying Bitcoins from miners in India is also not unacceptable. The quantum of stock is however too small and most Bitcoin stocks are traded stocks where people buy and sell Bitcoins through different exchanges.

Technically, buying Bitcoins from international sources is an “Import” of a “Commodity” which needs to be examined for FEMA issues.

At present, Bitcoin has not been identified it as a “Commodity” nor as a “Currency”.  It does not figure in the “Negative list” for imports nor in the white list of  foreign currencies that can be exchanged by Authorized dealers.

Hence, importing Bitcoin could be  considered not yet a clear violation of the import regulations. But at the same time, there is no guarantee that it cannot be ruled as a “Black Currency” in future either by RBI itself or by any Court.

Policy makers need to therefore consider if they should allow accumulation of Bitcoins by Indian residents or not, At the same time  the economic impact of not regulating Bitcoin acquisition and trade in India and by Indian residents need to be evaluated and responded to.

If holding of the Bitcoins accumulate in the hands of honest citizens in India, there is a possibility that sooner or later it will be sought by those who have to pay ransoms to criminals  or for use in funding terrorists. If an exchange market develops in India where Bitcoins can be sold and bought for rupees widely, terrorists and havala operators will use it to meet their requirements. Inevitably there after, Government will have to “demonetize” Bitcoins to ensure that there is no damage to the economy.

This could put the honest holders of Bitcoin into difficulty and force a sharp drop in its prices.

I therefore urge RBI and Government not to remain complacent , let Bitcoin stocks accumulate and subsequently force the Government to initiate a crack down. Such a move will adversely affect innocent citizens while the criminals and terrorists simply move off into another mode of funding.

Recently, I  came across a situation where a person had sold bitcoin for Indian rupees only to find that the rupee was transferred to him from a hacked Bank account. When police contacted him, he had to part with the money to the account holder. But he  could not take legal action against the fraudster since the asset (bitcoin) he had sold against the fraudulently acquired money was gone to the anonymous world of Bitcoins.  He had received Indian rupees which was part of a fraud and had to face the criminal charge of having been an accomplice though by innocence. Since the commodity dealt with has no recognition either has currency or commodity law may neither protect such persons nor help them take action against the real fraudsters.

I therefore feel that lack of regulation of Bitcoins is more harmful than a benefit to the community of honest citizens who may buy Bitcoins as an investment attracted by the sharp gain over the past few months.

One way to ensure that genuine holders of Bitcoins who have imported Bitcoins from their hard earned money are not subjected to problems on a later date, is for RBI/Government to regulate Bitcoin import by restricting its imports only through “Authorized Bitcoin Changers” so that every Bitcoin transaction is reported to RBI.

Holders should also be required to declare their Bitcoin assets in the Income Tax returns  and account for short term or long term gains.

By these twin measures, honest citizens who want to invest in Bitcoin may do so at their own price risks but without the additional risk of a Government crack down on the legality of the transaction.

If however, RBI does not consider Bitcoin acquisition by Indian residents as desirable, they should include “Crypto Currencies” in the negative import list or “Restricted Import list” so that requests can be handled on some reasonable criteria.

Doing neither….and drifting…. is not advisable.

Naavi

In a bid to reactivate the Cyber Appellate Tribunal, the Government of India has decided to merge it into a single larger entity with Airports Economic Regulatory Authority Appellate Tribunal will be merged with the Telecom Disputes Settlement and Appellate Tribunal.

The proposal is being introduced as part of the Finance Bill 2017 which will be passed during this budget session and hence will be a reality soon.

The details of how the operations will be structured will perhaps be released in the form of a new set of rules.

It is good that CyAT is being re-activated. But we need to wait and see how it will be useful to the Cyber Crime Victims as a flexible low cost operation.

Naavi

Recently UIDAI filed a criminal case against three entities namely Axis Bank, Suvidhaa Infoserve and e-Mudhra and temporarily barred them from using the Aadhaar authentication services.

The allegation was, that these agencies had indulged in “Unauthorized Access” of the UIDAI server and committed “Impersonation” with “Forged Digital Identities”.

What these entities did can be called “Stored Biometric Attack” where the biometrics of a valid user given for a valid transaction is copied and stored unauthorizedly and used subsequently for other transactions.

We can appreciate UIDAI for having identified the unauthorized nature of the transactions by a statistical evaluation of the biometric parameters.

It was obviously a violation of the contractual arrangement between the UIDAI and the authenticators and  UIDAI can take both civil and criminal action.

Under Section 34 of the Aadhaar act, the offence was punishable with imprisonment upto 3 years and a fine.

At the same time under ITA 2000/8, the offence could be charged under Section 66, 66C and 66D each having an imprisonment of upto 3 years.

Though the accused defended their position by stating that they were only doing a testing of the process and hence there was no fraudulent intentions, primafacie offence was established.

Under any due diligence process therefore, the regulators namely RBI for Axis Bank and CCA for e-Mudhra had to take some action that justified that they had also taken note of what could be potentially called a “Criminal Breach of Trust” and “Contravention of multiple statutes”.

Since UIDAI server is also a “Protected System” under Section 70 of ITA 2000/8, even an attempt to access it except in an authorized manner is an offence which may invoke imprisonment of upto 10 years and arrest without bail provisions.

We however donot know if UIDAI, RBI and CCA have all agreed to ignore the serious nature of the offence and condoned the offence. Since a complaint has already been filed, Police should also agree to look at the other way and probably a competent Court needs to approve the compromise as a compounding under Section 77A of ITA 2000/8 and or other provisions of law.

In the meantime it is observed that e-Mudhra website shows that CCA has initiated some punitive action against the Certifying authority by disallowing renewal of earlier digital signature certificates issued by the Company while not yet barring issue of new digital signature certificates.

The note on the website states “As per the latest CCA Identity Verification Guidelines, renewal of digital signatures is no more permitted. It is required to carry Fresh identity proofing for each DSC to be issued till further orders.“

It is not clear if this is a fall out of the UIDAI case or it was for some other irregularity in e-Mudhra’s KYC process observed by CCA.

However, this opens up a debate on what the order could mean for the present and immediate future for e-Mudhra customers and holders of digital certificates issued by e-Mudhra in the past.

Firstly, if any current holder of a valid digital certificate issued by e-Mudhra approaches them for renewal, they are advised to submit physical documents of identity and address proof duly attested by a Bank Manager or a Gazetted officer etc. In other words, the earlier digital certificates issued by e-Mudhra and confirmed by CCA is not accepted as valid for the parameters represented there in which are presumed to be “Un Trustworthy”.

If so, it means that the digital certificate is being declared void or “revoked”. Hence any contracts, tenders etc signed using these certificates in the past may also be considered invalid. All these contracts need to be re-signed to protect the contractual interests of the parties.

Secondly, e-Mudhra has the responsibility for KYC but it is  refusing to do its own KYC or accept the past KYC represented by the current digital certificate and instead pushing the applicants to Bank Managers who charge commission for attestation from the customers. In other words, the cost of KYC is being pushed to the customers besides making the Bank Manager responsible for the validity of the digital certificate issued by the Certifying authorities.

This is an anti-consumer issue which CCA should not allow.

Also, if the Certifying authority wants to use the attestation of a Bank Manager, it needs to enter into a contractual arrangement with the Bank and consider the Bank as its “Agent for KYC” and also incur the expenditure directly. This was the system when digital signature certificates were originally issued in and around the time of their origin in India around 2002.

Since e-Mudhra does not have the specimen signature of any Bank Manager, the KYC has no legal footing and it would be easy for fraudsters to forge the signature of Bank Managers and obtain digital certificates completely eroding the sanctity of the digital signature system in India.

This is a serious fraud risk to the digital signature system in India.

Companies like e-Mudhra does not have an adequate process of Grievance Redressal as per Section 79 of ITA 2000/8 and CCA has not so far asserted its authority and ensured ITA 2000/8 compliance by these agencies. Hence I have not been able to get official clarifications directly from the company in this regard.

In case there is any doubt about  e-Mudhra’s past certificates being tainted according to CCA, there is a need for CCA to disclose the circumstances under which e-Mudhra has been advised not to renew the old digital certificates except with a new set of physical KYC documents.

If however, irregularity if any is not serious, but the CCA took the extreme step of disallowing the renewal not recognizing the legal effect of casting a doubt on the reputation of e-Mudhra as a “Trusted” party and a custodian of the identity of all its existing digital certificate owners, it should admit its mistake and immediately revoke its order so that e-Mudhra can start renewing its current digital certificates online.

At the same time, e-Mudhra needs to also disclose on the website the position of the UIDAI complaint and its implications on the criminal liability which extends through Section 85 of ITA 2000/8 to all the Directors and the officials in charge of the business.

It should also be a disclosure under corporate Governance both at E Mudhra and its holding company, failing which it may attract attention of SEBI.

I have tried to obtain clarification on this matter from both e-Mudhra and CCA over the last one week but it is clear that the seriousness of the issue has not been recognized. My queries have not gone beyond the customer service executives to the senior management.

I hope that at least now, both e-Mudhra and CCA would move fast and try to resolve the issues raised here. In the meantime, I have raised a formal Adjudication complaint against e-Mudhra with CCA and awaiting the response. I suppose this will perhaps be the first adjudication application filed with CCA and hence some procedural precedence need to be established for future guidance.

I regret the inconvenience/embarassment this may cause to e-Mudhra which in the past was actually better than some other Certifying authorities in following good practices. But in the interest of the digital certificate environment in general and the interests of adoption of the right practices in the interest of Indian consumers, we cannot brush under the carpet the current issues and hence I am bringing this to public knowledge.

Naavi