The National Cyber Security Policy, 2013 (NCSP) May Face Implementation Hurdles

Indian government has finally released the much awaited national cyber security policy (NSCP), 2013. It took India many years to learn and appreciate the importance of cyber security but still this is a good step in the right direction. The policy is at the infancy stage as its actual implementation is yet to take place.

The policy is a broad outline and it is still lacking on many counts. Cyber security of India must be improved so that Indian cyberspace can be a safe place to do personal and business related online transactions.

According to the exclusive techno legal cyber security research and development centre of India (TLCSRDCI),  the objectives of the NCSP 2013 include creation of a cyber ecosystem in the country, encouraging open standards, strengthening of regulatory framework, securing e-governance services, critical infrastructure protection, promotion of research and development in cyber security, spreading cyber security awareness, providing fiscal benefits to businesses for adoption of standard security practices and processes, developing effective public private partnerships and collaborative engagements through technical and operational cooperation.

All of these objectives require tremendous techno legal cyber security expertise and capabilities. These objectives cannot be achieved overnight and they require systematic, continuous and dedicated efforts on the part of Indian government.

For instance, India has no dedicated cyber security legal framework. It would take Indian government decades before it come up with comprehensive cyber security legislation. Even the present cyber law of India is grossly offensive and is unconstitutional on numerous counts. Experts have even suggested repeal of the same. In these circumstances meeting the regulatory framework objective of the NCSP would be expecting too much from Indian government.

Similarly, the cyber security awareness in India is also missing. Though Indian government has prescribed a requirement to provide cyber security awareness brochures by electronic products vendors, including hardware vendors, yet nobody is following this direction in India. A legislation mandating strict cyber security disclosure norms in India has also been proposed by Indian government but there is no progress on this front as well.

Meanwhile, Indian PMO has sanctioned Rs. 1,000 crore to strengthen Indian cyber security. Indian security agencies are promoting their own cyber security agendas and they are insisting upon indigenously made cyber security software usage in India.

No doubt the NCSP is praiseworthy but the real question is would India be able to achieve the objectives prescribed by the same? Keeping in mind the previous track record of Indian government it would be safe to presume that the national cyber security policy, 2013 (NCSP) may face implementation hurdles in India if the Indian government does not pursue the same in proper and holistic manner.

Central Monitoring System Of India Launched Without Any Parliamentary Oversight And Legal Framework

The dangerous central monitoring system (CMS) of India has been finally launched as per various media reports. However, till now no confirmed and official report has been provided by Indian government in this regard.

The CMS is an e-surveillance and law enforcement tool in the hand of Indian government and its agencies. However, the entire concept of e-surveillance and projects like CMS is full of controversies. India has no constitutionally sound lawful interception legal framework.

Both phone tapping and e-surveillance are done in India without any judicial intervention and purely at the executive level. Even the law enforcement and intelligence agencies of India are not governed by constitutionally sound legal frameworks.

It is only now that the group of ministers has been constituted to draft law for central bureau of investigation (CBI) to make it autonomous and insulate from executive interference.

This is an alarming situation especially when governments around the world are engaging in limitless and unregulated e-surveillance. This has forced even the United Nations to raise its voice against civil liberties violations by various national governments.

India has been playing with the propose privacy bill for long and there seems to be no intention on the part of Indian government to enact the same. Till Indian government respects the privacy rights and civil liberties of Indian citizens, we must use self defence measures to protect the same.

Central Monitoring System Of India Is Extremely Dangerous And Violates Civil Liberties

This is the Guest Post of Mr. Praveen Dalal, managing partner of New Delhi based ICT law firm Perry4Law. The post outlines how the Central Monitoring System of India works and why it is dangerous for civil liberties in India.

Much has been discussed about the Central Monitoring System of India. For those who are still wondering what it is all about, the central Monitoring System (CMS) of India is a Big Brother Project of Indian Government without any Legal Framework, Procedural Safeguards and Parliamentary Oversight.

In short, beware as the big Brother is Listening. However, the Big Brother is not only listening but the Big Brother has Exceeded its Limits as well. The “Blanket Implementation” of the central Monitoring System (CMS) Project of India is violation of Civil Liberties in Cyberspace. The CMS Project would be “Illegal and Unconstitutional” if implemented in its “Current Form”.

But the crucial question is how would the CMS Project achieve its task of E-Surveillance in India? The CMS project could eavesdrop on all incoming, outgoing and ISD calls, text, messages, etc and the same can be monitored “At Will and at All Times”.

This would be achieved by passing all forms of Digital Communications through the Centralised System. Consider it to be “Refined Form of Men in the Middle (MITM) Attack” that is capable of knowing everything leaving your Mobile or Computer.

As you have to connect “Through the ISP” for gaining Internet access, you are passing through the MITM System of Indian Government that has been Illegally and Unconstitutionally Established.

ISPs would have no option in this regard as their Telecom Infrastructure would be passing through the CMS System and there would be no need to take their assistance every time the Indian Government wishes to do E-Surveillance or Eavesdropping.

In India there is no requirement to obtain a Court Warrant to engage in E-Surveillance and Eavesdropping. Even the lawful Interception Law in India is also missing. Both the Indian Telegraph Act, 1885 and Indian Information technology Act, 2000 carries many “Unconstitutional Provisions” and “Both Deserve to be Repealed”.

In short, the CMS System is an Illegal and Unconstitutional MITM System that does not require any Court Warrant or Permission to engage in E-Surveillance. CMS Project is another Unconstitutional Project like Aadhaar that has been imposed upon Indian Citizens. The Aadhaar Project has already been questioned in many Indian Courts and CMS Project would be next in line.

India is not only using the FinFisher Malware but the command and Control Servers of FinFisher are also Established in India. Spyware and Malware can be implanted upon the “Targeted Machines” with great ease and with the CMS in place this would be a child’s play. Wake up and fight for your Civil Liberties because if Rights Are Outlawed, Only Outlaws Will Have Rights in India.

Indian Government Wishes More Indian Software For Better Cyber Security

There is no second opinion that cyber security in India must be improved. Even Indian government has accepted this proposition and has admitted that it is a late entrant in this field. Indian government has also announced that a cyber command for armed forces of India would also be established.

India has also formulated the cyber security policy that carries many far reaching reforms in the field of cyber security. The policy has stressed upon indigenous development of hardware and software. Even the security agencies of India have been insisting upon using Indian cyber security software for protecting India’s critical infrastructures. Security agencies re also insisting that VoIP services providers wishing to do business in India must establish servers in India.

It has also been suggested that India must launch its own social media websites so that law enforcement problems can be avoided. As cyber litigation against foreign websites in India is going to increase, we must ensure that they comply with Indian laws. But this is not happening and recently U.S. government also refused to serve Indian summons upon foreign websites located in their jurisdiction.

Recently it has been reported that U.S. government is the biggest buyer of malware. Further, it is also a known fact that even the anti virus and security products can be manipulated to install malware upon victim’s system.

Thus, the decision to use Indian security softwares may seem absurd on the face of it but it is a very crucial and relevant decision. Foreign hardware and software may have backdoors installed in them. If we have indigenously manufactured software and hardware, we can analyse the same for backdoors. Let us see how things would take shape from this stage.

NATO’s Tallinn Manual Has Started Raising Objections

Recently the NATO cooperative cyber defence centre of excellence (NATO CCD COE) released a manual titled the Tallinn Manual on the international law applicable to cyber warfare.

The effort is the first of its kind to provide a non binding and unofficial document to provide guidance regarding applicability of international law to cyber warfare activities. However, from the very beginning, cyber security experts have been warning that this document can create real troubles in the global cyberspace.

According to Praveen Dalal, managing partner of ICT law firm Perry4Law and leading techno legal expert of Asia, “The effort is Significant as it is the first Coordinated and Collaborative effort in the direction of tackling the menaced of Cyber Warfare at the International Level. However, this effort of NATO is also “Highly Risky” and “Pre Mature” as “International Consensus” is not an essential part of this effort”.

It seems now others have also endorsed this viewpoint of Praveen Dalal. Now it has been reported that Russia has warned against NATO document as legitimising cyber wars. According to Russian experts, while Russia is trying to prevent militarisation of cyberspace by urging the international community to adopt a code of conduct in this sphere, the United States and its allies are already agreeing the rules for prosecuting cyber warfare.

The “Real Problem” is that we have no “Internationally Acceptable” Cyber Security and Cyber Law Treaty, says Dalal.  In the absence of such “International Harmonisation”, the documents like Tallinn Manual are “More Problem than Solution”, opined Dalal.

NATO must be very cautious while releasing such documents as they may have serious consequences. This may also be seen as a backdoor entry for the rules and regulations prescribed by U.S. that other nations would not found very convincing and binding. 

The Uncontrolled And Unregulated Organ Transplantation Mafia In India

Organ transplantation mafia of India is working right under the nose of India government that also without any fear or law and punishment. In one such reported incidence, the organ transplantation mafia has crossed all the limits of humanity.

The parents of a girl child have accused that medical workers in India have murdered their daughter to sell her organs to the rich receivers of such organs. They have also claimed that neither the medical staff nor the police have cooperated with them and they have hushed up the matter.

A request to Indian government has also been made to look into the matter and get the matter investigated through central bureau of investigation.

Medical malpractices in India have increased significantly. Whether it is deaths due to clinical trials in India or online selling of medicine by pharmacies in India, nothing is in order.

As far as organ transplantation is concerned, we have the Transplantation of Human Organs Act, 1994. However, the same requires urgent amendments to make it more effective and stringent.

It has failed to deter the organ transplantation mafia of India and sending a dead body to the relatives of an innocent child without crucial organs is a very gruesome act that requires punishment of most stringent nature.

We hope that Indian government would not allow any such incidence to reoccur in future and no parents would find themselves in this unfortunate situation as the unfortunate girl child’s parents are.

They deserve justice and not the one that is presently prevailing in India but an instant and appropriate one.

Indian Central Monitoring System: Part II

 The central monitoring system (CMS) of India has reiterated the long claimed notion of civil liberty advocates that the big brother is listening. While this may be tolerable to the extent of genuine law enforcement requirements but a blanket implementation of the central monitoring system (CMS) project of India has proved that the big brother has exceeded its limits.

Civil liberty protection in cyberspace is the cherished mandate of every democratic and constitution abiding government. However, countries around the world are not only ignoring this obligation but are also actively working in the direction of violating the same. Spy software like FinFisher is openly used by governments around the world.

In shocking news, it has been reported that command and control servers for FinFisher were found in 36 countries including India. The malware FinFisher has also tried to hide itself behind genuine software like Mozilla Firefox and Mozilla has issued a cease and desist notice to Gamma International for maliciously using its brand and reputation.  

The central monitoring system (CMS) project of India is one of the most controversial projects about to be launched by Indian government. It the CMS project of India is attached with other controversial projects like Aadhaar; this would be a serious civil liberty fiasco. The Aadhaar project is already questioned in the Indian courts and the CMS project would also face similar fate. The fact is that India must reconcile civil liberties and national security requirements immediately.

According to Praveen Dalal, managing partner of New Delhi based ICT law firm Perry4Law and leading techno legal expert of Asia, The CMS Project of India is a good and ambitious project that is required to manage National Security and Law Enforcement requirements of the country. However, adequate “Procedural Safeguards” must also be established in the System so that it is not abused for political and personal reasons, warns Dalal. The CMS Project would be “Illegal and Unconstitutional” if implemented in its current form, warns Dalal.

India is giving wrong signals to the entire world. In the present circumstances it is not wrong to conclude that India is not only adopting double standards but is also abdicated the rule of law. Further, the draconian cyber law of India must be repealed as piecemeal actions on the part of various activists would not help us in the long run.

The PMO must interfere at this crucial stage and scrap both Aadhaar and CMS projects as soon as possible. Recently U.S refused to sign the treaty that could have regulated Internet in the worst form. U.S. has also refused to serve summons upon Internet companies of U.S. citing constitutional reasons.

India has to mend its ways so that it remains on the side of protection of civil liberties and use e-surveillance in only those cases that are absolutely required.