Aadhar Cards sent by ordinary post

Aadhar numbers are being issued by the Government of India as a once in a life time identification number for a resident of the country. Many consider this as a “Sensitive personal Information” which is going to be linked with the Bank accounts, and several other vital activities of an individual.

If the Aaadhar number falls into wrong hands, it has the potential to be misused.

UIDAI is maintaining that “Aaadhar” is only a “Number” and the document they send is not a “Card”. It is a number which can be quoted to a service provider such as the Bank and the Bank can use it for identifying the individual not because of his posession of the Aadhar card, but with the use of his biometric. This means that every time aadhar ID is to be used, the individual has to provide his biometric (such as the finger print) and the user has to make a query to the UIDAI data base to confirm “Is this the ID of MR…? Yes or No”. The data base is expected to reply either Yes or No.

However in practice and more so since the verification mechanism is unlikely to be available for some time now, the Aadhar paper (let us call it a Card though UIDAI would maintain that it is not a “Card”) will be used by the public as a Photo ID. It is likely to be used for all and sundry applications including railway ticket booking, bank accounts, etc.

Under these circumstances, I was shocked and surprised that I was delivered my cards today by the postal department through ordinary mail. The covers carried a stamp of only Rs 5 and had not even been gummed. They were left by the postman in the letter box on my compound. Though UIDAI had taken my mobile number, they did not alert me that the cards are being delivered.

If this mode of delivery is being used as a routine, the possibilities of the cards being lost and misused on a large scale is a certainty.

Government of India owes an explanation to this callous way of handling the delivery of the aadhar card. If the Card is lost in transit, will Aadhar issue duplicate cards? If not should people manage without a “Card”? with some unknown person having the card in his possession and using it as an ID?

Naavi

Posted in Cyber Crime, Cyber Law, Privacy | 2 Comments

Indian Copyright Law 2012

The amended Copyright Act was notified for effectiveness on 21st June, 2012. The related rules were also released for public comments before 21st September 2012.

The amended Copyright Act has brought several aspects of digital work into the copyright domain.

There is a need for a detailed study of the amendments from the perspective of Cyber Space implications of the amended copyright Act.

Some brief comments of these aspects had been provided in Naavi.org earlier. In the coming days attempts will be made to add to this knowledge base.

I invite other Copyright specialists to contribute their ideas into this “Indian Copyright Law 2012” discussions.

Naavi

Posted in Uncategorized | Leave a comment

Mobile Framework for E Governance

Government of India has announced a mobile governance framework to make use of the increasing mobile usage in the country. It is estimated that there are 870 million mobile users whom the Government aims to provide access to e Governance services.

The detailed framework is available here:

One of the key components of the framework is the creation of “Mobile Services Delivery Gateway” (MSDG) which will be a shared infrastructure for both Central and State Governments.

The MSDG will ensure that content would be deliverable to different kinds of mobile devices including land lines, basic mobile devices,smart phones, tablets, laptops etc. Mobile Application Store (m-apps) and APIs developed.

It is also proposed that an authentication system based on Aadhaar will also be developed.

A mobile payment gateway will also be part of this infrastructure.

Interesting days are ahead for mobile users and service providers.

The framework does not specifically speak of any information security measures and we have to wait and see how data security is being addressed.

Naavi

Posted in Cyber Law, Privacy, Uncategorized | Leave a comment

One more aspect of ITA 2008 needs to be referred to Supreme Court

Presently two important petitions regading ITA 2008 are before the Supreme Court. The first petition Shreya Singhal v. Union of India has argued that Section 66A of the Act is unconstitutional and needs to be deleted. The second petition Dilipkumar Tulsidas Shah v. Union of India, W.P. (C) 97/2013 has sought definition of a proper system for regularization of the cyber crime investigation process. Supreme Court has issued necessary notices in this regard to the Union of India.

It is to be noted that if these petitions are taken to the logical end, the Supreme Court may provide a “Cyber Criminal Procedure Code” which could be a manual for the Police. This is welcome though it appears sad that the highest Court of the country has to spend its time on a routine administrative manner which should have been addressed by the officials of the Ministry of Communications and Information Technology/Department of Electronics and Information Technology/Department of (MCIT/DEITY).

While these petitions have brought to the attention of the Supreme Court the requirements for defining proper procedures in the pursuance of the criminal prosecutions under ITA 2008, it is necessary for us to also bring to the notice of the Supreme Court that MCIT/DEITY is  floundering on the civil justice aspects of ITA 2008 also.

It may be recalled that under Section 61 of the Act, ITA 2008 has placed all civil proceedings where a victim of a contravention of ITA 2008 can claim compensation upto Rs 5 crores exclusively under the jurisdiction of the “Adjudicators” as defined under Sections 46 of the Act. MCIT assumed complete responsibility for this cyber judiciary system by appointing the IT Secretaries of State Governments and Union Territories as the adjudicators for each state or Union Territory. MCIT also appointed the Controller of Certifying Authorities (CCA), another quasi judicial authority from out of its own ranks.

As a result the MCIT/DEITY which has assumed complete responsibility for formation of the Indian Cyber law in the first place has also assumed complete responsibility for the maintenance of the Civil judicial system.

The criminal justice system was being administered by the traditional infrastructure consisting of the Police, the public prosecutors and the Magistrates. But it was still the MCIT which called all the shots when it came to any clarifications on the law. Hence if we have come to a situation where the Supreme Court has to draft the “Cyber Criminal Procedure Code” today, it reflects on the inefficiency and incompetence of MCIT in managing ITA 2008.

While attention is now focussed on the revision of the Cyber Crime investigation process and drafting of some of the sections, it is necessary to point out that the same incompetence can also be identified in the administration of the Civil Judicial aspects of ITA 2008.

Firstly, the only appeal system called the “Cyber Appellate Tribunal (CAT)” which has to hear the appeals of all the adjudicating officers of the country has been kept dysfunctional since July 1, 2011 when the then acting “Presiding Officer/Chairman” attained super annuation. Despite being aware of this possibility by lapse of time, MCIT did not take any action to appoint a replacement in time. Further in December 2011, Justice S.K.Krishnan was appointed as “Member Judiciary” for the CAT but was not designated as “Chairman”. As a result he was not empowered to conduct any hearings. Justice Krishnan completed his tenure by November 2012 and attained super annuation without hearing any case. Now that even he is not available, MCIT has still not been able to appoint any other person as the “Chair Person” so that CAT can become functional. The department has however appointed a “Member Technical” and also a “Head of Department for CAT” but they have no role in conducting the judicial proceedings of CAT.

In view of the current situation, if any Adjudicator passes any decision in a State or Union Territory, one of the aggrieved parties can file an appeal and the proceedings get stalled.

There are several such appeals now pending at the CAT where the victims of Cyber Crimes are waiting endlessly for justice. This matter has been repeatedly brought to the attention of DEITY officials as well as the Minister/s in charge without any action.

In the State of Karnataka, the problem has been compounded further because the Adjudicator in an earlier decision has ruled that “No Company can invoke any proceedings under Section 43 of ITA 2008 and No complaint can be invoked against a Company under Section 43 of the Act”. As a result, until this decision is over turned in an appeal no civil proceedings can take place in Karnataka. Appeal on this is now pending at CAT and since CAT is dysfunctional, Karnataka Civil proceedings under ITA 2008 is also dysfunctional for the time being.

MCIT/DEITY has singularly failed in its duty to public in either training its own executives properly on the Cyber Law aspects nor in taking proper administrative decisions in time. It is therefore not reasonable to expect that they would be able to  set things right on their own.

There is therefore a need for Supreme Court to intervene even in this case and set right the civil procedure system as per ITA 2008. Supreme Court needs to think if MCIT/DEITY is capable of administering the ITA 2008 or a decision has to be taken for a total change of the system which may perhaps require another major surgery to ITA 2008.

Perhaps some body may file another PIL at Supreme Court requesting the Supreme Court to also consider defining the civil procedure system of ITA 2008.

Naavi

Posted in Cyber Crime, Cyber Law | Leave a comment

Supreme Court to consider PIL for regulatory framework for Cyber Crime

Based on a writ petition [Dilipkumar Tulsidas Shah v. Union of India, W.P. (C) 97/2013] filed an industrialist based in Pune, who was arrested for an alleged cyber crime, the Supreme Court has on Friday issued notice to the Central and Maharashtra governments in a public interest litigation (PIL) seeking framing of regulations and guidelines for effective investigation of cyber crimes.

The petitioner has argued that because of the ignorance of investigative agencies and the lack of a regulatory framework with respect to cyber crimes in India, instances of misplaced application of penal provisions of the IT Act and the Indian Penal Code are rampant. He also submitted that the same has, consequently, resulted in the violation of fundamental rights.

The petitioner has sought directions against the respondents to carry out proper and widespread awareness campaigns particularly for investigating agencies, intermediaries such as internet service providers and the judiciary, regarding the various forms of cyber crimes sought to be criminalized by the IT Act or any other penal law used to tackle cyber crimes.

The Court issued notice to the respondents and clubbed the matter with Shreya Singhal v. Union of India wherein similar issues were raised. Both the matters will be heard together.

More details

Naavi

Posted in Cyber Crime, Cyber Law, ITA 2008 | Leave a comment

Jharkhand Police introduces “Responsible Disclosure”

Jharkhand Police appears to have taken some steps on Cyber Security  which are very innovative and a model for other states.

They have set up a “Cyber Defense Research Center” (CDRC) as a joint initiative of the State Government and the State Police. The vision is to set up an organization which works on the overall protection of Cyber Assets and Critical Infrastructure in the State.

Apart from working on cyber crime area, CDRC has introduced an innovative “Responsible Disclosure” scheme inviting the public to report Cyber Security Breach incidents . Ethical Hacking community has been invited to report “Vulnerabilities”. (See FAQ here)

An online Complaint system has also been introduced. CDRC will also be handling the Cyber patrolling obligations.

CDRC is also taking up the responsibility for training the judiciary also on Cyber Crimes and also assessing the Vulnerabilities in the State IT infrastructure.

Overall the concept unveiled is a model system which the undersigned has been discussion for several years now.

Whoever is responsible for introducing the concept must be heartily congratulated. Other states should take a leaf out of the example and emulate the Jharkhand scheme.

We hope the system will be continued irrespective of the changes in the officials involved in promoting the concept.

Naavi

Posted in Cyber Crime, Cyber Law | Leave a comment