The Great Data Robbery… Why it is a national security issue?

This is a continuation of the previous article “The Great Data Robbery in India…64 crore data sets…weaponized for the next election...”

We have seen many data breaches from Hospitals. Banks, Payment Gateways etc. Most of these are targeted at financial crimes and result in ransomware attacks or direct phishing attacks. But what has been unearthed now in Cyberabad appears different. This data heist is not limited to financial objectives.

The classification of the data into different categories is really intriguing and raises alarm. The catch has been of a person who is said to be operating through a website “InspireWebz”.

We can stumble upon www.inspirewebz.com which is a website which is marketing several “Data Extractor Softwares”. Whether the arrested person is a user of this these tools or the owner of this website is not known. But the data extractor tools marketed in this website are clearly tools that can be used to commit what a data protection law would consider as “Objectionable Extraction”.

We are aware that DPDPB 2022 considers extraction of data from publicly available data space does not require specific consent. However, systematic marketing of these tools is facilitating criminals and hence the website should be considered as part of a “Conspiracy” to commit Cyber Crimes.

From the initial indications, the person arrested by Cyberabad police could have bought all the available tools in this website and later filtered and classified the data into different categories.

The press report referred to in the earlier article lists about 109 categories besides 25 state categories.

The classifications state wise had the following information.

The state-wide classification read along with the profession wise classification indicate multiple mis-use possibilities.

It could be used for all types of Cyber Crimes and also for structured AI assisted communication including sending deep fake videos to influence the free choice of the public during the next elections on the lines of what Cambridge Analytica was accused of.

It is time for data protection and cyber security community to debate how this threat should be viewed. Is it a simple cyber crime? or Cyber Terrorism?. Is it only an “Attempt” or an “Executed crime”? What are the labilities of all those who might have purchased the different packs of software? How have they used it? By this time all buyers should have been raided by NIA and records should have been collected on their activities.

Naavi