Centre for Internet and Society

Privacy Newsletter February 2017

praskrishna — 2017-07-20T14:00:13Z

For more details visit https://cis-india.org/internet-governance/files/privacy-newsletter-february-2017.pdf

Cyber Security Newsletter (September 2016 - June 2017)

praskrishna — 2017-07-20T13:45:18Z

For more details visit https://cis-india.org/internet-governance/files/cyber-security-newsletter-september-16.pdf

Indians Call For More Stringent Data Protection Laws

praskrishna — 2017-07-18T13:36:49Z

The government is India is facing calls to establish better cybersecurity laws to protect consumers’ data after fears have crept up that Reliance Jio, the telecom startup in India, suffered a major data leak.

This report was published by PYMNTS on July 17, 2017. Pranesh Prakash was quoted.

According to a report in Reuters announcing the news, Jio denied the data leak took place, saying the names, telephone numbers and email addresses of Jio users that showed up on Magicpak, a website, were unauthentic. Its parent Reliance Industries said customers’ data was safe and protected.

But at the same time that it was issuing reassurances, Jio filed a complaint claiming unlawful access to its computer systems, reported Reuters. That discrepancy has led Indians to call for better laws for data protection for consumers.

“It raises questions of security and accountability,” said Pranesh Prakash, policy director at the Centre for Internet and Society (CIS), a research organization, in the report. “A rule to report breaches exists, but it is unenforceable. It says you’re not liable if you’re following reasonable security practices. What ‘reasonable’ means is not defined.”

Supporters of stronger data protection laws in India said that countries that have stronger cybersecurity laws on the books would have started an inquiry into what happened with Reliance Jio. They point to the data breach last week at Verizon. Verizon quickly responded with an explanation of what went down, how it occurred and how many customers’ data privacy it impacted.

“India is at a nascent stage. For good norms in Asia, look to Singapore. It’s been praised for not having cybersecurity issues by the UN,” Srinivas Kodali, an independent security researcher, said in the same Reuters report.

The report noted that in May there were two data privacy breaches of Indian companies with the records of 17 million Zomato customers being compromised. In another breach, as many as 135 million of India’s Aadhaar numbers had been stolen from government databases and placed online. Aadhaar numbers are similar to social security numbers.

For more details visit https://cis-india.org/internet-governance/news/pymnts-july-17-2017-indians-call-for-more-stringent-data-protection-laws

WSIS Forum 2017

praskrishna — 2017-07-18T02:00:44Z

WSIS Forum 2017 was held 12-16 June in Geneva, and included the participation of more than 85 high-level government and civil society representatives, as well as 500 remote interventions and thousands following the webcast. The forum was chaired by Mr Jean Philbert Nsengimana, Minister of Youth and ICT, Government of Rwanda, and co-organized by ITU, UNESCO, UNCTAD and UNDP, in close collaboration with all UN agencies. Nirmita Narasimhan participated in the forum.

The moderator, Ms Andrea Saks (Chair, Telecommunication Standardisation Sector (ITU-T) Joint Coordination Activity on Accessibility and Human Factors (JCA-AHF)), welcomed the audience and introduced the five panellists, two of whom were remote participants.

The first speaker, participating remotely from India, was Ms Nirmita Narasimhan, Policy Director, Centre of Internet and Society (CIS). Narasimhan heads the CIS accessibility inclusion programme and specialises in policy research and advocacy related to technology access for persons with disabilities. Narasimhan focused on a report (link is external) jointly prepared by ITU and CIS, on how to leverage ICTs in an accessible manner to ensure that persons with disabilities and other vulnerable groups are included in planning and responding to disasters and situations involving emergency situations. She raised four stages of preparedness (link is external) for disaster management: (1) early warning planning including creating awareness, education, and training material as well as setting up technological infrastructure; (2) alerts as to when a disaster is happening and where to go for help; (3) recovery, what happens after the disaster; and (4) mitigation which leads back to planning and preparedness. Full report here. More information on the event here.

For more details visit https://cis-india.org/accessibility/news/wsis-forum-2017

Centre to form panel to 'encrypt' MGNREGA-DBT database and prevent leaks

praskrishna — 2017-07-14T10:46:45Z

Around 5 crore bank accounts of active MGNREGA workers yet to be seeded with Aadhaar.

The article by Sanjeeb Mukherjee was published in the Business Standard on July 14, 2017.

Alarmed over reports of ‘public disclosure’ of sensitive Aadhaar data through various portals and payment gateways, the Centre is in the process of appointing a high-powered panel of almost 20 experts to suggest ways and means through which data, particularly one which can be accessed through the MGNREGA-DBT platform can be encrypted.

Encryption, officials believe, would prevent the Aadhaar data and other related information from falling into wrong hands.

The need for proper encryption of Aadhaar data rose after the government made it mandatory for availing almost all benefits - be it school scholarships, payments of MGNREGA wages, identification of beneficiaries under mid-day meal scheme and even public distribution system along with others.

Ensuring cyber security has become all the more necessary as the Central government, in a notification issued last month, has made it mandatory for all bank accounts to be seeded with Aadhaar numbers by December 31, 2017, or else they would cease to be operational until the time the account holder furnishes his Aadhaar number.

This could seriously hamper payment of wages to MGNREGA workers because as per available information almost 5 crore active workers don’t have their bank accounts seeded with Aadhaar.

To complete the process before December 2017, the ministry of rural development has planned special Aadhaar camps to be held in villages from July 20 to September 2017.

Recently, a website published all confidential details of customers of a private telecom company including Aadhaar numbers and other information.

The breach was another instance of secure confidential information falling into public domain.

Officials of the panel, which would be headed by former NASSCOM head Kiran Karnik are expected to submit their report on the same within the next few months.

Other members of the panel include Director General of National Institute of Smart Governance (NISG), officials from Indian Computer Emergency Response Team (ICERT) and others.

However, cyber security experts believe that encrypting Aadhaar-DBT details mainly for those schemes and programmes which have a direct linkage with the public at this later stage has its own challenges as the entire ecosystem around Aadhaar has grown manifold ever since it was made mandatory for a variety of programmes.

Also, in the absence of a national encryption policy, such a move will have its own legal and regulatory challenges.

“Ever since the government made Aadhaar mandatory for many things, the entire ecosystem around it including the Central Identities Data Repository (the agency which stores Aadhaar data is exposed to leaks,” noted cyber law expert Pawan Duggal told Business Standard.

He said that without a proper national encryption law, it would be extremely challenging to provide legal and regulatory backing to encrypt all Aadhaar- DBT data details for MGNREGA. “Also now that the ‘cat is out of the bag,’ encryption of Aadhaar details will be hugely challenging,” Duggal said.

Already, civil society activists said that after some concern, the central government has removed all Aadhaar numbers and bank details from MGNREGA website, which has made tracking payments difficult.

A recent study by Amber Sinha and Srinivas Kodali from the Centre for Internet and Society (CIS) found that granular details about individuals including sensitive personally identifiable information such as Aadhaar number, caste, religion, address, photographs and financial information are only a few clicks away through government schemes dashboard and portals.

“While initiatives such as the government open data portals may be laudable for providing easy access to government data condensed for easy digestion, however in the absence of proper controls exercised by the government departments the results can be disastrous by divulging sensitive and adversely actionable information about the individuals who are responding units of such databases,” the report said.

It specifically studied two major schemes of the ministry of rural development; the National National Social Assistance Programme and MGNREGA along with some state schemes.

Pointers

a) Centre to form a panel to encrypt all MGNREGA-DBT database to prevent leaks.

b) The panel might also suggest ways and means in which such ‘encryption’ could be applied in other platforms.

c) The panel is expected to be headed by former NASSCOM head Kiran Karnik.

d) The encryption is essential as from January 2018 all non-Aadhaar seeded bank accounts will cease to be operational unless the holders seed them.

e) A recent study found that vivid details about individuals can be easily accessed from government platforms and databases.

f) The MGNREGA database was one such publicly available platform which formed part of the study.

For more details visit https://cis-india.org/internet-governance/news/business-standard-sanjeeb-mukherjee-july-14-2017-centre-to-form-panel-to-encrypt-mgnrega-dbt-database-and-prevent-leaks

Supreme Court sets up constitution bench to hear Aadhaar privacy issues

praskrishna — 2017-07-14T10:55:04Z

The Supreme Court ‘s five-judge constitution bench will also decide if the Aadhaar privacy issue should be heard by a larger bench.

The article by Priyanka Mittal was published in Livemint on July 12, 2017. Sunil Abraham was quoted.

A five-judge constitution bench will hear arguments on 18-19 July as to whether Indian citizens have the right to privacy, and whether the Aadhaar unique identity project breaches the right.

Chief Justice of India (CJI) J.S. Khehar on Wednesday set the dates for the hearing by the constitution bench, which will decide whether the issue should be heard by a larger bench.

Should the five-judge bench decide to rule on the case itself and not refer it to a larger bench, it will decide the future of Aadhaar, which has become the backbone of government welfare programmes, the tax administration network and online financial transactions.

This will be based on whether the right to privacy is a fundamental right of Indian citizens.

Privacy rights activists argue that personal data gathered under the Aadhaar programme, aimed at giving a unique 12-digit identity number to every Indian, is vulnerable to abuse. Then attorney general Mukul Rohatgi told the Supreme Court in 2015 that Indian citizens don’t have a fundamental right to privacy under the Indian Constitution—an argument he repeated subsequently.

“In the two-day hearing, the court is not going to decide the full issue of privacy,” said Alok Prasanna Kumar, a lawyer and visiting fellow at think tank Vidhi Centre for Legal Policy, explaining how the Constitution bench is likely to proceed. “They are going to take a call on whether, in light of precedents, there is a need to refer the issue to a larger bench. There are past judgements and the court will have to look at the scope of privacy under each to decide the number of judges.”

He added: “If the five-judge bench agrees with the precedents, then it would continue to address the angle of privacy; if not, then it would be referred back to the CJI to constitute a larger bench of nine judges.”

All cases related to Aadhaar, including the right to privacy, will be heard by the constitution bench; the court decided to set up the constitution bench to hear the privacy case in August 2015.

The CJI’s decision came on a plea by advocate Shyam Divan, who has appeared in several cases opposing Aadhaar, and attorney general K.K. Venugopal seeking the speedy creation of a Constitution bench. It came a week after justice J. Chelameswar said that all matters related to Aadhaar should be addressed by a constitution bench.

“I see it as a step in the right direction. Personally, I hope that the privacy issue is heard by a five-judge bench as against a larger bench as that can bring more disagreement,” said Sunil Abraham, executive director of Bengaluru-based research think tank Centre for Internet and Society.

Last month, the Supreme Court court upheld the government’s decision to link Aadhaar with the permanent account number (PAN) for filing of income-tax returns but ruled that non-compliance with the law will carry no retrospective consequences.

Under the Aadhaar (Targeted Delivery of Financial and Other Subsidies, Benefits and Services) Act, 2016, the unique identity number is mandatory only to receive social welfare benefits.

For more details visit https://cis-india.org/internet-governance/news/livemint-priyanka-mittal-july-12-2017-supreme-court-sets-up-constitution-bench-to-hear-aadhaar-privacy-issues

Reliance Jio data leaked on website : report

praskrishna — 2017-07-10T14:53:42Z

Reliance Jio customer data was leaked on independent website magicapk.com, including details such as names, mobile numbers and email IDs , said a report.

The article was published by Livemint on July 10, 2017.

Reliance Jio Infocomm Ltd’s customer data was allegedly leaked on an independent website, magicapk.com, a report said. Jio, which crossed the 100 million mark in February, barely six months after it was launched, ended the financial year with 108.9 million subscribers as of 31 March.

The report, published first in a late-night article on Sunday on Fonearena.com, alleged that “several sensitive details” were exposed, including customers’ first and last names, mobile numbers, email IDs, circles, SIM activation dates and even the Aadhaar numbers. The Aadhaar numbers, however, were redacted on magicapk.

“To my disbelief I found my own details in the database and also couple of my colleagues are affected too,” wrote Varun Krish, the author of the article. However, if you now click on Magicapk.com, it reads: “This Account has been suspended .” The Registrar of the site, according to the whois database, is Godaddy.com, LLC.

When contacted, a Reliance Jio spokesperson said, “We have come across the unverified and unsubstantiated claims of the website and are investigating it. Prima facie, the data appears to be unauthentic. We want to assure our subscribers that their data is safe and maintained with highest security. Data is only shared with authorities as per their requirement. We have informed law enforcement agencies about the claims of the website and will follow through to ensure strict action is taken.”

Fonearena.com, on its site, has responded with a: “We still stand by our story.”

The report assumes significance because the site exposed redacted Aadhaar card details. There are nearly 1.2 billion Aadhaar number holders in the country. Aadhaar aims to plug leakages in the delivery of state benefits, such as subsidized grains to the poor, and aid in generating a savings of about Rs70,000 crore a year for the government. But data breaches have rattled citizens, especially since India does not have a Privacy Act.

In March, the Unique Identification Authority of India (UIDAI) blacklisted a common services centre for 10 years after it shared the Aadhaar details of former cricket captain Mahendra Singh Dhoni. On 25 April, Mint reported that many government departments, including the ministry of drinking water and sanitation, the Jharkhand Directorate of Social Security, and the Kerala government’s pension department, had published Aadhaar numbers of beneficiaries of the schemes they run in violation of the Aadhaar Act .

On 1 May, Bengaluru-based think tank Centre for Internet and Society (CIS) reported that a Central government ministry and a state government may have made public up to 135 million Aadhaar numbers .

Under the Aadhaar (Targeted Delivery of Financial Subsidies, Benefits and Services) Act, 2016, the unique identity number is mandatory only to receive social welfare benefits. However, tagging of the Aadhaar number is being made mandatory by the government for various schemes including PAN (permanent account number) accounts for taxation. On 7 July, the Supreme Court refused to pass any interim order against the mandatory use of Aadhaar for various government schemes. It, instead, suggested that petitioners call for immediate formation of a Constitution bench to decide on the case .

News of the alleged data leak also comes at a time when there have been a spate of cyber hacks.

For instance, just when companies started believing that WannaCry—the malware that held over 200,000 individuals across 10,000 organizations in nearly 100 countries to ransom—was on the wane, a virus christened GoldenEye (a variant of the Petya ransomware) by security firm Bitdefender Labs attacked companies, mostly in Ukraine. And while the target primarily appeared to be European countries, the ransomware was also reported to be making inroads in countries like India.

For more details visit https://cis-india.org/internet-governance/news/livemint-july-10-2017-reliance-jio-data-leaked-on-website-report

Act now to protect yourself against future ransomware attacks

praskrishna — 2017-07-10T14:46:14Z

There was Wannacry, then Petya, and several other lesser-known ones: With ransomware attacks coming thick and fast, get proactive about protecting yourself.

The article by Sanjay Kumar Singh was published by Business Standard on July 5, 2017.

The Wannacry ransomware attack in May was followed by the Petya attack last week. This attack affected the Ukrainian government and large corporates like Maersk and Merck. In India it affected the operations of terminals at Jawaharlal Nehru Port Trust (JNPT), operated by Maersk. According to Kaspersky Lab, the rate of ransomware attacks on businesses grew from one every 120 seconds in January 2016 to one every 40 seconds by October that year. The rate of attack on individuals' computers rose from one every 20 seconds to one every 10 seconds over this period. Today, it has become imperative for everyone, including entrepreneurs and small business owners, to learn how to defend themselves against such attacks.

A trend witnessed in 2016 was the growth of ransomware-as-a-service business model. "Code creators offer their malicious product on demand, selling uniquely modified versions to criminals who then distribute it through spam and websites, paying a commission to the creator," says Altaf Halde, managing director, Kaspersky Lab (South Asia). He adds that the growth of cashless payments in India will undoubtedly attract the attention of cyber criminals and lead to more attacks in future.

Next, let us turn to how ransomware works. An operating system (OS) is a large and complicated piece of software with millions of lines of software code. A malware exploits vulnerabilities within the OS to infiltrate it. An infiltration can happen in multiple ways: if you download a malicious email attachment, visit a code-carrying web site, via an infected pen drive, and so on.

Ransomware is a form of malware that encrypts the files in a critical part of the computer, such as My Documents or Desktop, where people usually store their files. It could also encrypt specific file types, say, such .doc files. The user is then informed that his files have been encrypted along with the warning that unless he pays up within the next few hours his files will be deleted. Says Udbhav Tiwari, policy officer at the Centre for Internet and Society, Bengaluru: "You first have to first pay the attackers using anonymous money like bitcoins and then they give you the key for decrypting your files."

A ransomware attack can be dealt with in two ways: either pay the money and get the files unlocked, or find a way to circumvent the encryption. The latter option can, however, take a fair bit of time.

Safeguard measure you should adopt
Back up important files regularly. Check periodically that these files have not got damaged Enable ‘Show file extensions’ option in Windows settings. Stay away from extensions like “exe”, “vbs” and “scr”. Many familiar file types can be dangerous as scammers use multiple extensions (like hot-chics.avi.exe or doc.scr) If you discover an unknown process on your machine, cut off the Internet connection immediately If you have been infected, find the name of the ransomware. If it's an older version, your files can be restored. For restoration tools visit https://www.nomoreransom.org/

Among the safeguard measures you should adopt, first and foremost, never open a suspicious file. By being vigilant you can avoid a lot of ransomware attacks.

Most malware exploit vulnerabilities within the OS. "These vulnerabilities are frequently patched by the creators of the OS. But if people use pirated OS, or don't upgrade it regularly, they could land in trouble," says Tiwari. Soon after the Wannacry attack, Microsoft had issued a patch. People who updated their computers immediately didn't get affected by it. Also, use the latest version of an OS.

Use a quality antivirus (AV) solution, which is usually one you have to pay for. A high-quality AV can even protect you against vulnerabilities not patched by the OS manufacturer. AVs scan files. If they detect patterns indicating the presence of malware, they lock them apart from the rest of the computer, thereby preventing them from spreading.

One option is to use an OS that is less vulnerable, like Mac and Linux. Fewer malware are designed for these OS as fewer people use them.

Finally, if your files do get encrypted, don’t pay the ransom, unless instant access to those files is critical. "Each payment only fuels this unlawful business," says Halde.

For more details visit https://cis-india.org/internet-governance/news/business-standard-july-5-2017-sanjay-kumar-singh-act-now-to-protect-yourself-against-future-ransomware-attacks

Freedom of Expression on the Internet : Possibilities and Challenges

praskrishna — 2017-07-09T02:30:32Z

Sharat Chandra Ram was a speaker at an international seminar organized by Bolivar Technological University, Cartagena in Colombia on June 29, 2017. The theme of the seminar was ‘Freedom of Expression on the Internet : Possibilities and Challenges”.

For more info on the event, click here

For more details visit https://cis-india.org/internet-governance/news/freedom-of-expression-on-the-internet-possibilities-and-challenges

Disabled demand rollback of GST on aids

praskrishna — 2017-07-09T02:21:46Z

It has been eight years since Mansoor Ahmed changed his caliper. The one he owns was bought for Rs 20,000. Now, they cost more than double. “It is a challenge to buy a caliper when the cost of living has gone up so much. I know really poor people who haven't changed calipers in 15-20 years. After a point, it could cause the disability to worsen,“ says Ahmed, a senior manager with a Bengaluru-based non-profit.

The article by Sandhya Soman was published in the Economic Times on July 7, 2017.

For disabled people like Ahmed, the 5% GST on basic aids and appliances like calipers, Braille writers and cochlear implants is an additional load. “We are already burdened by other costs -illnesses and medicines. It's quite unfair if I must pay more if I have to walk,“ says Ahmed.

The decision to tax aids and appliances for the disabled continues to draw flak despite a hastily put together statement last week reducing GST and capping it at 5% for 22 categories of products. Cars will continue to have 18% GST even if they are retrofitted for a disabled driver. The disabled find it hard to reconcile that they will have to shell out more while items such as sindoor and bangles got a waiver. This is the government that launched the Ac cessible India campaign and Inclusive India campaign. I don't understand why they should charge people to walk with a cane,“ says Nirmita Narasimhan, policy director, The Centre for Internet and Society.

The economic burden is accentuated by a lack of institutional support, whether in terms of accessibility to public transport or provision of affordable aids. “There is close correlation between poverty and disability . Most of us can't step out of our houses as roads, pavements and public transport are inaccessible,“ asks Javed Abidi, director, National Centre for Promotion of Employment for Disabled People.

Narasimhan notes in her submission to the government that the 21 million disabled record low literacy level (59%, below national average of 74.4%) and low work participation (36.3%).

To reduce the financial burden, Abidi and others fought to do away with taxes on aids since 2000. “We could bring down tax rates, sometimes as high as 20%, on various items to 5%. In 2006, it became zero and the last decade was the most important one for disability rights. Instead of making aids more affordable, we are now going back 10 years and charging 5% again,“ says Abidi, a wheelchair user.

For more details visit https://cis-india.org/accessibility/news/economic-times-july-7-2017-sandhya-soman-disabled-demand-rollback-of-gst-on-aids

Presentation at NIC

praskrishna — 2017-07-09T01:40:19Z

Presentation at NIC

For more details visit https://cis-india.org/home-images/PresentationatNIC1.png

Digital Accessibility

praskrishna — 2017-07-09T01:44:08Z

On June 17, 2017, Rakesh Paladugula, a web accessibility trainer and Nirmita Narasimhan made a presentation to scientists of the National Informatics Centre in their office in Bengaluru.


Pictured above: Nirmita Narasimhan explaining concepts of digital accessibility to a group of scientists at National Informatics Centre office in Bengaluru

The presentation described what is digital accessibility, who it benefits, how to implement it in terms of policy and technology, standards for different domains of accessibility and focused specifically on making web sites accessible as per GIGW. The presentation was attended by around 40 scientists in person and approx. 40 from the districts of Karnataka via video conferencing. The discussion also revolved on key issues with Government web sites, available resources and tools to check for accessibility and tips on how to make them accessible. Some thought was also given to what could be the plan going forward to implement GIGW and any capacity building requirements in this regard.

For more details visit https://cis-india.org/accessibility/news/digital-accessibility

Cybersecurity - Threat or Opportunity

praskrishna — 2017-07-07T02:42:28Z

For more details visit https://cis-india.org/internet-governance/files/cybersecurity-threat-or-opportunity

2nd China - India Think Tank Forum Report

praskrishna — 2017-07-07T02:39:36Z

For more details visit https://cis-india.org/internet-governance/files/2nd-china-india-think-tank-forum-report

Second India China Think-Tank Forum

praskrishna — 2017-07-07T02:43:09Z

The second India-China Think-Tank Forum was held in Beijing from June 22 to 27, 2017. The Forum was jointly organized by the Institute of Chinese Studies, the Indian Council of World Affairs, and the Chinese Academy of Social Sciences. Saikat Dutta represented an Indian think tank.

The Forum was set up following an MoU between India and China during the visit of Prime Minister Narendra Modi in 2015. The idea of the forum is to explore contentious issues and new areas of cooperation between India and China as a Track 1.5 dialogue. Read More

Click here for the report

Click to read Saikat Dutta's presentation

For more details visit https://cis-india.org/internet-governance/news/second-india-china-think-tank-forum