E-Banking In India

Reserve Bank of India (RBI) has come across many complaints and disputes regarding fraudulent credit card, online banking and ATM transactions. Even phishing incidences have sharply arisen in India resulting in loss of money of public at large. RBI ombudsmen office has been flooded with such complaints.

In these circumstances, online banking in India is risky. We have no e-banking laws in India and this also makes the mobile banking in India risky. Even RBI has acknowledged risks of e-banking in India.

E-banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, managing partner of New Delhi based law firm Perry4Law and leading techno legal expert of India, we have no dedicated E-Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet or E-Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

Recently, G Gopalakrishna, the executive director of RBI, said that all Banks would have to create a position of Chief Information Officers (CIOs) as well as Steering Committees on Information Security at the Board Level at the earliest, informs Dalal. This step was taken to ensure proper Cyber Security Policies and Strategies at the highest Board Level of Banks, says Dalal.

Although RBI has mandated cyber due diligence for banks in India especially the due diligence for banks under IT Act 2000 yet banks have still to keep their functions in order. Indian banks are poor at cyber security and they are in no mood to appoint CIOs and steering committee.

Recently the final report of working group of RBI on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds has been released. It has prescribed the time limits for implementation of RBI recommendations on information security. With the deterrent approach of RBI towards non compliance, it would be safe to presume that CIOs, steering committee and cyber security related compliances would also be taken seriously by RBI.

It is high time for banks operating in India to keep their e-banking infrastructure technologically and legally sound. The best option for banks seems to be to adopt Techno Legal Measures that covers both Technical and Legal aspects of Banking, suggests Dalal.

Mobile Cyber Security In India

Mobile phone has become an important aspect of our daily lives. We use mobile phone for multi purposes including mobile banking and mobile governance. With the use of third generation spectrum, even better, speedier and more productive use of mobile phones is now possible.

However, of all the benefits of use of mobile, we cannot ignore the risks associated with it. For instance, the mobile banking in India is risky as the present banking and other technology related legal frameworks are not conducive for mobile banking in India.

Similarly, we do not have a well developed e-governance infrastructure in India. Naturally, India is still not ready for m-governance. India does not have any infrastructure, legal framework, policies and strategies and most importantly expertise to implement these ambitious projects.

The biggest hurdles before the mobile related uses in India pertain to use of weak encryption standards and non use of mobile cyber security mechanisms in India, informs Praveen Dalal, managing partner of New Delhi based law firm Perry4Law. Absence of encryption laws in India has further made the mobile security very weak in India, says Dalal.

Mobile viruses and worms are further increasing the woes of mobile users’ world wide, claims Dalal. Recently 50 applications within Google’s official Android Market were found to be contaminated with DroidDream malware. The malware stole sensitive information like phone’s International Mobile Equipment Identity (IMEI) Number and the SIM card’s International Mobile Subscriber Identity (IMSI) number. It then sent it to a command-and-control server, informs Dalal. Similarly, other spyware and bugs are also infecting mobile phones worldwide

Instead of making the encryption requirements redundant and weak, India must concentrate upon further strengthening the same for better and secure mobile communications. Governments of most developed countries allow the usage of strong encryption standards ranging from 128 bits to 256 bits or more to ensure the security of sensitive information exchanged via Internet and other networks. However, India is still clinging to 40 bits encryption standards for the simple reason that intelligence and security agencies of India are not capable enough to break strong encryptions.

In fact, threats have been issued by Indian government to services providers providing encrypted mobile, e-mail and VOIP services. Gmail and Skype have been asked to provide the encryption keys to Indian government and its security agencies. However, neither Google nor Skype have admitted of receiving any such communication. India is also indirectly pressurising Blackberry to help India in its e-surveillance activities. These actions of Indian government would only make mobile security weaker.

Indian population is still not interested in mobile cyber security and if the default encryption protection is also taken away, mobile usage in India is definitely going to be suffered from malware attacks and cyber attacks. India must urgently concentrate upon mobile security so that these infected mobile cannot be used by criminals.

Steering Committees On Information Security By Banks In India

Cyber crimes have increased a lot in India. Cyber crimes have not left any field or commercial activity untouched. Even the banking sector has not remained unaffected by cyber crimes. Further, the cyber law of India has introduced its own set of due diligence requirements for banks operating in India.

Realising the gravity of the situation, the Reserve Bank of India (RBI) has recently released a report of its working group on information security, electronic banking, technology risk management, and cyber frauds. In this report, the RBI mandated cyber due diligence for banks in India.

The matter does not end here. It is clear that RBI has to meet great challenges before Indian banking industry can be considered reasonably safe from cyber criminals. This is more so when we have inadequate cyber laws and other laws to effectively tackle cyber crimes pertaining to banking sector of India.

Internet banking is increasingly becoming popular in India. However, Internet banking is a risky venture and India must be prepared to deal with the risks associated with it. The increasing cases of ATM frauds, online banking frauds, credit cards frauds, etc have shaken the confidence of Indian consumers in Internet banking in India.

However, Internet banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, leading techno legal expert of India and a Supreme Court lawyer, we have no dedicated Internet Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

Similarly, the present banking and other technology related legal frameworks are not conducive for mobile banking in India. We do not have a well developed e-governance infrastructure in India. Similarly, on the front of e-commerce as well, India is not much successful.

In this background, the requirements of cyber due diligence of banks in India has become more onerous. RBI has further made this requirement absolute through its Information Technology Vision Document 2011-17. According to this policy document, all banks now would have to create a position of chief information officers (CTOs) as well as steering committees on information security at the board level at the earliest.

The presence of CTO and steering committees on information security would ensure that banks are following cyber due diligence and other technology and non technology related due diligence requirements in India, says B.S.Dalal, a banking and financial law expert and senior partner of Perry4Law. Till now there was no such requirement and banks were taking cyber law related issues lightly. RBI has taken a good step in right direction and this would increase the confidence of bank customers of India.

Internet Banking Laws In India

Internet banking is increasingly becoming popular in India. However, Internet banking is a risky venture and India must be prepared to deal with the risks associated with it. The increasing cases of ATM frauds, online banking frauds, credit cards frauds, etc have shaken the confidence of Indian consumers in Internet banking in India.

Similarly, mobile banking in India is also being explored. Some segments have suggested active use of mobile banking in India. While the idea is great yet India is still not ready for mobile banking. In fact, mobile banking in India is a risky business.

The problem of Internet banking frauds has become even more sever due to absence of legal framework in this regard. However, the Reserve Bank of India (RBI) has recently recommended use of “cyber due diligence” for banks in India. With the present guidelines, banks can no more ignore due diligence requirements that they have been ignoring for long.

Although the requirements of due diligence may arise out of many laws, but cyber due diligence is the most required one. Realising the seriousness of the situation, RBI has recently released a report of its working group on information security, electronic banking, technology risk management, and cyber frauds.

Previously, banks were required to manage due diligence arising out of laws alone but now the responsibility of banks have become very wide. The banks must now manage due diligence requirements of both technical and legal nature. In other words, the due diligence requirements of banks have now become techno legal in nature.

However, Internet banking in India cannot succeed till a strong legal framework in this is enacted. According to Praveen Dalal, leading techno legal expert of India and a Supreme Court lawyer, we have no dedicated Internet Banking Law in India. Although, RBI has issued many guidelines in this regard and even our Information Technology Act, 2000 contains some indirect and implied provisions for Internet Banking yet we need a separate and dedicated law in this regard, opines Praveen Dalal.

It would be a good idea if RBI starts working in the direction of enacting a suitable Internet banking law of India. The same may also incorporate cyber due diligence requirements and punishments for cyber crimes against banking institutions. The call is for the RBI to take and it would definitely take it.