Naavi.org

The RBI Deputy Governor Mr R Gandhi has confirmed that the recent cyber attack that was reported in Mumbai was on Union Bank of India but no loss might have been reported. Mr Gandhi also reminded the Banks about the new Cyber Security Framework that RBI wanted Banks to implement.

Under this framework, there was a need for Banks to confirm that a gap analysis had been completed and taken note of by the Board before July 31, 2016. Since the deadline has already passed yesterday (given the weekend holidays), it would be interesting to know whether at least one Bank has reported to RBI about the compliance to its compliance requirement. Since his statement is silent on this aspect, it can be presumed that no Bank has so far completed the gap analysis and got the approval of its board and reported it to RBI so far though one or two might have been able to complete the gap analysis at departmental level and kept it ready for presentation to the Board whenever it meets next.

 Now we need to watch out what would be the follow up action of RBI for non compliance of this first level default.

Naavi

In a little surprising but welcome development, the Government of India has released a notification under Section 67C of ITA 2008 viz G.S.R. 711 (E) dated 21st July 2016 titled “Information Technology (Preservation and Retention of Information by Intermediaries Providing Digital Locker Facilities) Rules 2016. which may not perfectly fit under Section 67C but is otherwise related to the setting up of a new regulatory authority called the Digital Locker Authority and defining a new set of business in the Digital India project.

Apparently, the purpose of this notification is to define the rules under which public documents shall be preserved and protected when lodged with the Digilocker authorities and the notification is issued under Section 67C of Information Technology Act 2000/8. It sets a new trend of “Data Retention” defined specific to a domain of activity.

Sec 67C was perhaps meant to define “how long” and in “what form” intermediaries may retain information and “manner” of retention was incidental. However, this notification actually goes to define the “Manner” in which a certain type of intermediary shall retain information without much emphasis on the format and period for which the information has to be retained. Also the “Information” referred to in the Section 67C  of the Act is being used to identify the “Documents” that a subscriber would like to lodge in the safe custody of an agency as an “Uniquely Identifiable Document” with an “URI” (Unique Resource Identifier). No specific structure for the URI like a standard structure for a URL has been defined as part of the “manner of retention of information” under Sec 67C.

It therefore appears that Section 67C has been used as an excuse to define some new business proposition which has its own implications for Digital India. It has redefined Sec 67C itself and altered its scope.

May be we can call this an innovative and creative interpretation of law but the possibilities of unintended consequences that may follow from a loosely regulated service needs to be watched out.

New Opportunities Unleashed

In effect, through this notification, the Government seems to have defined a new business proposition for private sector to develop services to set up and manage “Portal”, “Access Gateways” and “Repositories” to store electronic documents deposited by public and verifiable and retrievable by authorised entities.

The service as conceived is bigger than UIDAI and without a separate Act like the UIDAI Act, it enables a new system by which electronic documents are authenticated, preserved and verified.

Obviously there will be Privacy and Security issues as well to contend with.

Further, since the Main DigiLocker authority would be the Government, the notification provides an admission that its own department may now be considered as an “Intermediary” if it also provides its own digilocker services in addition to private sector players. Such department will therefore be subject to Sec 79 obligations.

To ensure protection of the department as well as avoid conflicts, it may be necessary for Deity to refrain from directly providing the digi locker service as they are dong now and to make the DLA as the regulator like the  Controller of Certifying Authorities which will only restrict itself to regulatory issues and not provide a service of its own. These should have been part of the notification such as “Appointment of a Digital Locker Authority”, but unfortunately they are not released as of now.  We need to wait for the notification  to be issued as a supplementary notification in due course.

The “Digilocker Credentials” which may ultimately be just the log in ID and Password will henceforth become a pointer to the other documents such as Aadhaar, PAN etc held within the Digital Locker and its security would be a key obligation of the service provider since it becomes a proxy to the subscriber’s identity.

Just as the Unified Payment Interface (UPI) is becoming a Universal identification for all financial instruments owned by an individual, this Digi Locker Account may become the universal identity document for an individual.

The Digi Locker service provider would be having a “Digital Locker Practice Statement” similar to the one used by a Certifying Authority for Digital Signature and would be bound by it.

The practice statement  would be a self declaration and only verified by an audit by an independent auditor. Since the Digital Locker Service Provider has to be gazette notified, the practice statement may be subject to an approval process.

The service provider would obviously be open to obligations under Section 43A for reasonable security practice and compliance of all aspects of ITA 2000/8.

At present the qualifications of an Auditor is not defined and I hope it would be determined on a “Ability to Audit basis” and not on a “Qualification Certificate Issued by Preferred entities basis”.

In summary, it appears that the Government through this notification has opened up a new business opportunity which is as responsible as a Licensed Certifying Authority in the case of a Digital Signature issue and the Unique Identification Authority of India (UIDAI) without an elaborate legislation. It could be an innovative approach but hopefully not questioned in the Courts for its validity.

The Start Up community may welcome this move as it opens up new opportunities where they can integrate several of their services.

We need to watch out how this notification gets absorbed by the community and harnessed for business.

Naavi

(These are preliminary views and more would follow)

The hacking of a Bangladeshi Bank last February where about $81 million was transferred by fraudsters hacking into the SWIFT Inter Bank money transfer system is a grim reminder of the weaknesses in our Banking eco system.

The detailed account of this heist as explained here, 

The article explains the suspected modus operandi used by hackers to book 35 fraudulent transfers amounting to nearly US$ 1Billion from the Central Bank of Bangladesh to  Federal  Bank of New York. By by some grace of God only 4 of these transactions were carried through and the loss was limited to $81 million. The principle cause could be the compromise of the access credentials of one of the Bank employees with a malware. What compounded the problem was the delays in cross verification arising out of holidays first in Bangladesh and then in New York  exposing the Bank to the huge loss.  Finally what prevented 30 transactions to be held up by the New York Bank was that one of the e-mail addresses contained the word “Jupiter” which was a black listed name of an Iranian Oil Vessel subject to certain sanctions. One transaction failed due to a spelling mistake.

Now a clear 4 months later a similar attack seems to have been repeated on one of the Indian Banks in Mumbai which again by a stroke of luck did not go through.

The incident has been reported in Economic Times here.

This time the US Bank was a little more alert to identify an unusual transaction and the Indian Bank was saved. At this point of time it is not clear which was the Bank involved except that it was a public sector Bank with headquarters in Mumbai. The Economic Times report indicates that the Stock Exchange has not been informed of the attempted fraud which should be considered as a violation of the SEBI norms.

The CERT IN guidelines require that the information regarding such security breaches need to be reported to them and even the latest RBI guidelines mandate reporting of such incidents. However Banks continue to hide the incidents and keep their investors in the dark until one day such frauds blow up on their faces.

One thing however is clear from these incidents that the security systems within the Banks has several short comings and if even the SWIFT transactions are unsafe, one can wonder how safe are the RTGS transactions.

Just like the Banks, customers also should pray for luck to be on their side to protect their funds from fraudsters!

Naavi

Since June 2016, there have been a flurry of activities in the RBI as regards formation of security guidelines that apply to the Financial Services Industry in general in India and Banking in particular.

First, there was the circular regarding “Cyber Security Framework” which required Banks to set up a “Security Operations Center” (SOC) and monitor even “Zero Day Vulnerabilities”.  Though the earlier information security guidelines of April 2011 following the GGWG (G Gopalakrishna Working Group) recommendations did press for many information security initiatives that the Banks should have taken which could be interpreted to include what is now being stated, none of the Banks had taken the GGWG guidelines seriously.

Now RBI  has taken a decisive step to alert the Board Members in Banks and more particularly the Independent Directors to not only take stock of the implementation status but also confirm to RBI that they have indeed done so. Additionally, Banks have been specifically directed to place the RBI circular and a Gap Analysis before the Bank’s board and send a report to DBOD, before July 31, 2016. They have also been given the deadline of September 30, 2016 for implementation of the Cyber Security Framework and confirmation to RBI.

Setting up of an SOC and more particularly to watch out for “Zero Day Vulnerabilities” calls for a high level of expertise, technical enablement as well as investment by Banks. Except the top few Banks, others may neither have the expertise nor the technical know how to maintain the SOC as required. There are also many smaller Banks which may not have the necessary resources to buy technological services required for the purpose. This has already sent most CISOs in Banks to a huddle and a feverish activity amongst those Banks which have the capability to understand the implications.Many others are likely to continue in their mode of “All is Well” and “Ignorance is Bliss” until they are jolted again by another followup  initiative of RBI if there is one.

Following this circular, RBI also released a “Vision Document” for the “Payment and Settlements Systems Industry” consisting of the  a focus on “Prevention of Frauds” in the payments eco-system which includes many private sector players who are today acting as business associates of Banks. A responsive regulatory framework was suggested to be developed which included new policies to be developed for the sector.

These measures clearly indicated that Banks would significantly increase their oversight on private sector FinTech companies who were hitherto working in the background while fraud risk exposure at least in perception terms was absorbed by the front end Banks. Though legally, under ITA 2008 the back end service providers were exposed to the risks of frauds, due to general ignorance of the customers and the Banks, they were not called upon to bear the risk of fraud losses.

This situation will now be changed. RBI has identified measures to increase the accountability of the back end service providers and even indicated that RBI may directly retain the power of regulating the back end service providers such as Payment Gateways, Authentication Providers, Customer Aggregators etc. While RBI may wait until it takes a direct plunge into regulating the intermediaries who work between the Banks and the End users of different services, it will definitely bring sufficient pressure on the Banks themselves to increase their supervision of the back-end service providers.

As a result, the back-end service providers which include many Start Ups in the FinTech industry will start feeling the heat of regulatory oversight soon. Since most regulations translate into a Techno Legal Compliance exercise at the service provider’s level, it will require additional investments which might not have been budgeted earlier. The VCs who have funded these companies will also have to take note of the new regulations and ensure that their funds are protected. In case these Tech Companies continue to ignore the compliance requirements in their operations, they are likely to face unpleasant surprises soon.

In a bid to develop policies that may be required for such regulation, RBI has recently set up a working group under the Chairmanship of Mr Sudarshan Sen, Executive Director. (We shall call this the SSWG).

It is time that the FinTech industry takes note of this development and tries to understand the implications of the setting up of the SSWG and its likely recommendations that may follow. The working group has been asked to submit its report in the next 6 months. Since this will be one of the first Working Groups that will define the role of FinTech companies in India, it will be a trend setter. But if the trend is set in a direction that the FinTech companies consider as incorrect, then their business will be adversely affected.

We may take note that in the recent past the Taxi Aggregators and the E Commerce Companies were at the wrong end of new regulations from politicians who did not understand the business. Since these companies also did not understand the mindset of the regulators, they failed to defend their interests and allowed regulations that are dysfunctional. As a result, a “Taxi  Service Aggregator” today is considered as a “Taxi Operator” and E-Commerce “Market Place” is considered as a “Wholesaler”.

The next axe will fall on the Health Information App companies and the FinTech Companies. If they donot wake up and take measures to protect their interests, they will regret.

I am not suggesting here that the FinTech companies should manipulate the regulatory framework contemplated by RBI. But I am surprised that FinTech companies donot find a representation in the SSWG though the decisions taken there could affect them. There is a need for the FinTech Companies to ensure that their voices are heard in the regulatory circles.

While organizations such as CII or FICCI ensure that policies are not generally detrimental to the industries they represent, FinTech Companies donot have a proper industry body to represent them. NASSCOM is also not represented in the SSWG and even if represented, it is not a reliable representative of the FinTech companies which are mostly small and micro enterprises.

There is therefore an immediate necessity for these entities to come together and form a body of “FinTech entitites” that understands the needs of this industry segment and represents it to the right authorities.

Since the SSWG has already been formed and in the next one month will start collecting data about the industry, it is high time for the FinTech entities to formulate their strategy of presenting a collective industry face to the SSWG and ensure that they are heard fairly.

I urge industry players to take the initiative and form a “Society of FinTech Entities”, enrol members, develop an industry representation that can be presented to the SSWG. The society can propose certain “Self Regulation” that would pre-empt any unreasonable regulations which may otherwise be imposed on them.

Since Bangalore is a hub of Start Ups and there are many FinTech companies working here, it is a food place to start with. If the industry players are interested in coming together to form such a “Society of FinTech Entities” and need any assistance, Naavi would be happy to assist them.

Naavi