Mobile Security Policy Of India

Mobile security in India has assumed a centre stage these days as more and more online services are attached to mobile phone. Whether it is micro payments through mobile or m-governance, mobile has changed the entire game of public delivery of services in India. The draft electronic delivery of services bill 2011 would further augment use of mobile phone for delivery of services in India.

These days’ malware writers have written specific malware for smart phones. Newer form of viruses and worms are regularly released that specifically target mobile phone. Mobile cyber security in India is need of the hour in these circumstances.

However, mobile security cannot be implemented in India till it is made part and parcel of the larger mobile security policy of India. New telecom policy of India 2011 is in the pipeline and it must include the aspects of mobile security as well.

Further, proposals are also there to constitute telecom security council of India. The council would consider the security aspects of mobile phone hardware and software. The council must play a pro active role for formulating national mobile security policy of India.

However, certain Security Related Issues must be resolved by India urgently, says Praveen Dalal, managing partner of Perry4Law and leading techno legal specialist of India. For instance, Encryption issues must be resolved by India as soon as possible, suggests Dalal. A Sense of Uncertainty among Mobile Service Providers is the last thing that India needs at this point, suggests Dalal.

India should start the ball rolling and formulate a national mobile policy of India that should include all aspects regarding mobile use in India. Mobile security policy must be an essential part of the same.

Mobile Cyber Security In India

Mobile phone has become an important aspect of our daily lives. We use mobile phone for multi purposes including mobile banking and mobile governance. With the use of third generation spectrum, even better, speedier and more productive use of mobile phones is now possible.

However, of all the benefits of use of mobile, we cannot ignore the risks associated with it. For instance, the mobile banking in India is risky as the present banking and other technology related legal frameworks are not conducive for mobile banking in India.

Similarly, we do not have a well developed e-governance infrastructure in India. Naturally, India is still not ready for m-governance. India does not have any infrastructure, legal framework, policies and strategies and most importantly expertise to implement these ambitious projects.

The biggest hurdles before the mobile related uses in India pertain to use of weak encryption standards and non use of mobile cyber security mechanisms in India, informs Praveen Dalal, managing partner of New Delhi based law firm Perry4Law. Absence of encryption laws in India has further made the mobile security very weak in India, says Dalal.

Mobile viruses and worms are further increasing the woes of mobile users’ world wide, claims Dalal. Recently 50 applications within Google’s official Android Market were found to be contaminated with DroidDream malware. The malware stole sensitive information like phone’s International Mobile Equipment Identity (IMEI) Number and the SIM card’s International Mobile Subscriber Identity (IMSI) number. It then sent it to a command-and-control server, informs Dalal. Similarly, other spyware and bugs are also infecting mobile phones worldwide

Instead of making the encryption requirements redundant and weak, India must concentrate upon further strengthening the same for better and secure mobile communications. Governments of most developed countries allow the usage of strong encryption standards ranging from 128 bits to 256 bits or more to ensure the security of sensitive information exchanged via Internet and other networks. However, India is still clinging to 40 bits encryption standards for the simple reason that intelligence and security agencies of India are not capable enough to break strong encryptions.

In fact, threats have been issued by Indian government to services providers providing encrypted mobile, e-mail and VOIP services. Gmail and Skype have been asked to provide the encryption keys to Indian government and its security agencies. However, neither Google nor Skype have admitted of receiving any such communication. India is also indirectly pressurising Blackberry to help India in its e-surveillance activities. These actions of Indian government would only make mobile security weaker.

Indian population is still not interested in mobile cyber security and if the default encryption protection is also taken away, mobile usage in India is definitely going to be suffered from malware attacks and cyber attacks. India must urgently concentrate upon mobile security so that these infected mobile cannot be used by criminals.