Monday 28 December 2015

The IT Act 2000. Time for a change

12:27 Posted by Unknown No comments
In the past decade, India has witnessed many changes. The "Aam Aadmi" , the same man who thought his views don't matter, now wants his "status" to come forward and be shared. The "Sanskaari Bahu" who used to shy away from people, is now gaining Instagram followers at the speed of thought. Be it "Sharma ji ka ladka" or "Tulsi ki Baa", everyone is trying to make his/her presence felt on the one platform that has made this world smaller. Internet. 
It has been estimated that by 2018, approximately 550 million Indians will have access to Internet services! To add to that, there is a 89% increase in the number of smartphone users in the last year with a whopping 51 million urban users. A simple conclusion can be drawn that access to the internet will no longer be a "privilege" but a necessity  in the coming years. 
But with each picture being uploaded, each website being registered, every dress you are buying from e-commerce site, you are readily giving your private details to some companies you think you can trust. But are your private details really safe?
The answer: No. Why you ask? Before you continue, I would like you to watch this short video :-





If you did watch the video, well done! Now you atleast realize that shit is serious out there. If you didn't, let me tell you : Shit is serious out there! Don't believe me? Go to :google.com/dashboard and let the biggest corporation in the world tell you everything about your past searches. Don't freak out just yet.
So, who is protecting you? What if you get hacked tomorrow, who you gonna call? 
Now there is an IT act of 2000, which is the backbone of cyberlaws in India. Although there is so much calcium deficiency in this backbone, doctors suggest surgically removing it(True Story). No, seriously, you can read about it anywhere but let me highlight some points:

1. CyberBullying: Like everything in India, the IT Act was also inspired by "Sanskaars" as the judiciary thought that children don't do anything wrong. Well, according to the 'Tweens, Teens and Technology 2014 Report' by McAfee, 50 percent of Indian youth have had some experience with cyber-bullying (been cyber-bullied online or witnessed others being so treated), out of which one-third (36 percent) have themselves been cyber-bullied. The IT Act  does not include any provisions relating to prevention /punishment /judicial procedure for crimes like cyber bullying by school students. The IT Act, 2000 mentions only two kinds of offences in this regard, namely i) publishing of information which is obscene (section 67 of IT Act) and ii) breach of confidentiality and privacy (section 72 of IT Act). The issue of bullying, teasing, hazing are not mentioned properly.

2.
Encryption Laws: Encryption has become an indispensable technology these days. Whether it is online banking, e-commerce or e-governance services, encryption is commonly used in all these services. Encryption ensures authenticity and legality to various transactions provided the same is done within permissible limits and in accordance with the applicable laws of India.
Unfortunately, we have no dedicated encryption law of India and encryption policy of India as on date. This has made the entire scenario very complicated. In fact, as on date most of the online service providers in India are in active violations of the encryption related laws, regulations and compliance requirements.
Cloud computing and virtualisation service providers are also violating the laws of India relating to encryption and cyber law due diligence requirements. Even the telecom security policy of India has failed to address the encryption related issues properly. The cyber security trends of India have also highlighted the inadequacies of cyber security of India and a part of the same is attributable to inadequate encryption and decryption capabilities of India.
3.Email Policy: Indian government and its departments have not only failed to formulate and implement a robust and cyber secure e-mail policy but they have also been negligent on the front of securing crucial and sensitive government and public data. As on date many sensitive data and documents are residing on the servers of foreign e-mail service providers from where they are openly available to foreign intelligence and security agencies to analyse.
The e-mail policy of India has been in pipeline for long but till now nothing has been done on this regard. This is a serious issue as e-mail is one of the favourite methods of cyber criminals to compromise computer systems and to gain sensitive and personal information. Further, service providers like G-mail are abetting and encouraging commission of cyber crimes as well. E-mail service providers like g-mail, yahoo, hotmail, etc are also facilitating violating the provisions ofPublic Records Act, 1993 wherever public records are involved.

4.Mandotary Decryption(aka Mera Whatsapp Govt Padh rahi hai): The Section 69 allows intercept any information and ask for information decryption. To refuse decryption is an offence. The Indian Telegraph Act, 1885 allows the government to tap phones. But, according to a 1996 Supreme Court verdict the government can tap phones only in case of a "public emergency". But, there is no such restriction on Section 69.

__________________________________________________________________________
I could list more loopholes in the Act but you get the point. So no email policy, no decryption, no definition for cyberbullying...IT ACT needs to act. Add to that the latest amendment giving government full access to our data!

Cybersecurity is unfortunately not being taken seriously by India. In this era of cyberwarfare and cyberterrorism, we lack not only manpower but a more important aspect, that is , awareness. People are slowly losing their right to privacy and the situation can go worse. To conclude,