Need to Security Private Information - Requirement in India

Unique Identification Authority of India (UIDAI) data center in Bangalore is reported to have got a cover of 65 star guards from multi-skilled security agency, the Central Industrial Security Force (CISF) - Your identity is guarded by 65 armed men (article on times of India).

It indeed is a commendable step by the authorities, but my question here is - Is this measure enough to secure the Identity and avert the threat from identity theft? Actually Speaking NO and the reasons that attribute to the answer NO are -

1. The personal information of an average Indian is scattered across the Government Offices, Public and Private Banks and other Financial Institutions to a large extent.  More scary portion is the availability of this information on papers across the offices
2. There is no defined mechanism to destroy the paper work by the various organizations and agencies.  Many a times some or other people from various organizations sell of these as waste papers to the scrap dealers.  There have been various incidents in past where papers with critical and sensitive information have been located with the road side vendors (bhel puri and other chat senders)
3. There is no defined guideline by the Government of India on how to use / dispose / destroy the information whether in paper or on computers
4. There are no set standards in India with respect to destruction or recycling of magnetic / optical media that may contain sensitive / private / identity information.  Such media may be Hard-Drives, Pen-Drives, Backup Tapes, CDs, DVDs, SD Cards etc among others
5. Nasscom has also not worked to this effect to advice with any standard guidelines to be utilized to this effect

Saying all this, we should not actually be cheering the news as published as it is the least of the measures that is required at deployment.  Another aspect to look at is - Has Government also provisioned a DR site for the UIDAI Data Center? Is that location also guarded with similar set of Security Personnel?  Unless we get that information, I guess this news is just a hogwash,

If you feel I am trying to belittle Government's efforts, then well I am not.  But my effort is to sensitize that there are additional steps required by the Government to ensure that the information related to the Identity of Indians as well as tourists / visitors to India is treated as sensitive and private.  Adequate measures as detailed below need to be put in place to ensure that such information is treated in fair and just manner - 

1. Enact a Data Privacy Law - Government needs to take immediate measures to ensure that the Data Privacy Law is enacted and enforced to set the expectations on dealing with Private and Sensitive Data.  The Information that needs to be treated as private and sensitive should include - Aadhar Number (as part of the UIDAI effort), PAN Card numbers (from Income Tax Authorities), Voter ID (from election commission), Ration Card, Passports and any other similar set of documents and information that can help establish the identity of any individual
2. Define Data Handling Guidelines - As part of the Data Privacy Law, Government must define the treatment of information classified as Private and Personal in a manner cognizant to safeguard the Identity of person holding it
3. Define Data Destruction Guidelines - As part of the Data Privacy Law, Government must also define how the data no more needed is to be destroyed.  For the data on paper and optical media for that matter must be destroyed by using shredders. The data on magnetic media for that matter must be destroyed by using programs that would over-write the data multiple times using different algorithms and thus rendering data as unreadable
4. Define Consent Requirement - Often this is one of the most overlooked case where the private and personal information of any individual is circulated / shared for commercial benefits.  There are cases where the Customer Relationship Officers or the Marketing Staff carries over the contact and similar other information to the next organization without consent of the Data Owners.  It needs to be noted that the receiving Organizations / Agencies are Data Custodians and not Data Owners, meaning they can use data for their internal processing purpose only.  For sharing or using data for any other reason than intended reason should not be permitted without consent from the Data Owners (Data Owner is the person about whom the information is)
5. Define Agreement Forms - Government must ensure that the Agreement forms used for the purpose of providing services are defined only for those services for which the Information is obtained.  Such Agreements must not any Clause or Fine Prints like "Organization / Agency may use this information for any of the required processing as may be deemed required by the organization / agency.

These are the basic steps to be taken to ensure Data Privacy & Protection.  These needs to be enforced along with the Indian IT Security Act 2008 Amendment Act to ensure that adequate Information Security Risks are addressed including the identity theft and information compromise.....
-------------------------------------------------------------------
Post is also available on 

Tech Notes GuruCool - Security and More

Urgent need to ban porn websites: Chief Justice of India

Another Article and another set of mixed responses on Banning or Blocking Pornography – “Urgent need to ban porn websites: Chief Justice of India”.

I sort of Agree with what CJI has opined for. If people say that there are ways to circumvent the ban, they are forgetting that there are ways to plug the loops that people might use to circumvent them. Technology today helps us banning and blocking anything that we want to ban and block. My question to those opposing it is - if you are accessing porn on a regular basis, aren't you habituated to it?? Porn is something that in a way might be related to this country and as I have already pointed out in another comment regarding the amendment to Indian IT Act, stiff resistance would be faced for banning and blocking these sites. There have been arguments that have poured in that the parents need to take ownership to ensure that their kids do not have access to porn sites. Well yes there are many tools for this matter including Net Nanny and other similar products that may be bought and subscribed for to be deployed on one's computer for blocking the porn / hate etc. But would someone come ahead and tell me on how many parents in India are technology and net savvy??? Bestowing only them with this responsibility (certainly they would be responsible for their kids any which ways)would mean regular counseling for them regarding this and to ensure that they are made acquainted to the issue of Pornography on the net. This will directly lead to more friction between the teenage kids and parents as kids would see it as another disciplinary control by parents. I would say the community needs to come out with a more comprehensive and better thought on this by way of evaluating the pros and cons of various steps / controls that can be put to effect.

Mayank Trivedi

E-mail - mayank.a.trivedi@gmail.com

Blog - http://www.myopinions.name

Tech Blog - http://matricsindia.net.in

Govt can't ban porn websites for obscenity

Just happened to read the Article “ - Govt can’t ban porn websites for obscenity

I was more shocked than surprised. Though this sort of inaction can very much be expected from the Govt, we certainly could not accept it. When the Indian IT Act amendments were being discussed and the amendment to the act were being looked at in 2008, it was a strong feeling and the Cyber Security Professionals were of the idea that the amendments would be making law bit more stringent in nature. Its exact reverse of what had been expected. I had numerous discussions with the various Cyber Security Professionals and Cyber Law experts and each one of them was expecting a drastic change in the way issue of Porn sites is dealt with. It was opined that the Govt would empower Cyber Tribunal or similar organization and convert it as a watch dog to govern the display, access and transmission of Porn material. Alas, it didn’t happen. Govt more so has cleared itself off from the responsibility on this front. Amendments to the section 69A are something that certainly have weakened the power as it was earlier identified for it. Moreover with assigning the power to block the Porn sites has been granted to the Courts and that too if a petition is filed in the Court for jurisdiction. Apparently, the govt has indirectly let Porn be prevalent in the Cyber Society, without giving a thought that this very porn is at times the cause to create nuisance in the society and leading to molestations, child abuses etc. Yeah it would be countered that how can we create the correlation between the two things. Incidentally some bright mind came up with a pretty Creative Thought – “May be Government Machinery and Think Tank would have thought as to when the Country has Given KAMASUTRA to the world, how can we stop Porn that is nothing but an extension to KAMASUTRA. They might have thought that if they block / ban porn in cyber world, the cyber community might come up with an argument that similar things are depicted as Artifacts and Artistic at various temples in Khajuraho.” Well may be, who knows.

But all said and done, don’t we think that too much of Porn is circulating around on the net and is unnecessarily leading to the situation of unrest and creating an atmosphere that would affect law and order negatively?

I am unable to understand as to Why govt can’t Enforce a Blanket Block at ISP Gateway levels? I guess rather than going with an approach of Law and Order, the Govt. can simply go ahead with issuing a notification to the ISPs to go ahead and Block all the Porn Sites right at the ISP Gateway Level itself. I don't understand what is stopping the Govt. from doing that? or do we take it this way that the Govt. machinery is pretty happy to let Pornography be prevalent till it affects the Public Order???

There are Countries where a Country level Proxy is set-up and that blocks all the Porn sites from being accessed. An argument may come up that the countries where this sort of set-up has been deployed are smaller countries with lesser Internet traffic, where in case of India the traffic is humungous to be managed by a central Proxy. So, let me clarify that I am not saying so. What my point is – If the Govt. wants to really act in this direction, it can instruct the ISPs to deploy measures at their levels to ensure that porn sites are completely Blocked out. Govt may also conduct periodic surprise audits of the ISPs to this effect and ensure that the directive as published is well followed by the ISPs.

Mayank Trivedi

Blog - http://www.myopinions.name

Tech Blog - http://matricsindia.net.in