Naavi.org

The Dark Web by definition is different from the legal “Deep Web” which is hidden from access through publicly accessible search engines like Google. Deep web is a space controlled by individual entities for their legitimate use and not illegal use. It is like a company’s premises where the entry is limited to authorized persons only.

On the other hand, by definition, the “Dark Web” is a “Zone of Illegal Virtual Operations”. It is in the dark web that criminals exchange crime tools, sell and buy drugs, weapons etc.

Having defined the “Dark Web” as the Criminal’s work place, there is no need to discuss if Dark Web needs to be allowed to exist. Without doubt it has to be eliminated though we may be incapable of doing it. Our incapability to fight the dak web is no justification not to declare it illegal and look at every body entering the dark web with an eye of suspicion.

The “Dark Web” thrives on a legitimate need for “Privacy” but the problem is “Privacy” is misused by criminals to hide their identity and run their business. The crimes have a reward in financial terms which are supported by the Crypto Currencies which act as the “Bankers to the criminals”. Hence Crypto Currencies (Privately managed) like Bitcoin are the support base for dark web apart from the Tor browser that enables access to the dark web.

If Dark Web has to be outlawed, we need to outlaw “Private Crypto Currencies” as well as the “Tor” browser or any other system that is used to access the dark web.

While “Privacy” is a legitimate right, “Confidential Banking is a legitimate right”, “Encryption for security” is a legitimate right, “Anonymity for security” is a legitimate right, these rights are bounded by the need not to cross the border of legality and cause harm to another individual.

This is a fundamental principle that every one agrees but is not able to support when the push comes to shove. The society is now at a time when we should bite the bullet and “Outlaw the Dark Web along with its components such as Bitcoin/private Crypto currencies and the Tor Browser”.

Just as Crypto Currencies may still exist like the Digital Rupee, or Guns in private hands may exist under a licensing system, we may still retain Tor as a “Licensed Software” to be used only by the law enforcement or registered security agencies who are committed to the legal activities.

Many may feel that this is impossible just as we cannot eliminate drugs, smoking or prostitution by just making laws against them. However it does not mean that the society should express passive support to any activity that is harmful to its larger good .

It is true that the existing laws itself make “Dark Web” and use of “Bitcoins” or “Use of Tor” illegal and punishable either as a crime or an attempt to commit a crime. Both DPDPA and ITA 2000 are laws which try to regulate and punish misuse of electronic information and are supported by BNS 2023. Section 15 of DPDPA 2023 imposes a duty on a data principal not to “Impersonate”. Section 66C and 66D of ITA 2000 makes “Impersonation” a cognizable offence. Section 4 of DPDPA 2023 prohibits illegal processing of personal data and ITA 2000 imposes criminal penalties for causing harm due to such processing.

Despite these laws, the society will not appreciate the need to keep Dark Web at a distance unless the Government comes out with a declaration that “Dark Web use is unlawful”. If any person is seen entering the Criminal’s Adda, it is his responsibility to explain to the law enforcement that his visit was for a legitimate purpose. More appropriately, any visitor to the criminal’s den has to take prior permission of the law enforcement.

I therefore call upon law makers in India to specifically pass directions to outlaw Dark Web, Private Crypto Currencies and Tor Browser and make their use subject to a strict licensing system.

This means that “Possession of Tor browser” should be considered as a “Prima Facie Evidence” of an intention to commit a crime and subjected to prior licensing just like the Gun licensing law. No organization should be able to sell tools that facilitate entry to Dark Web except under license.

I am aware that this suggestion may be radical but it is essential to protect the integrity of the digital society.

Those who agree or not agree are invited to participate in the virtual round table organized by Naavi.org and FDPPI on 17th October 2024, in commemoration of the “Digital Society Day” . You are invited to join the Zoom meeting between 6.30 pm and 8.00 pm in the link given above.

Naavi

P.S: Naavi.org urges the specialists to refrain from educating our youngsters on how to enter Dark Web. This is a promotion of crime. (Attention: Content Writer)

Also refer: Report on FBI strategy to disrupt Illegal Dark Web activities

The Star Health Insurance Data Breach has been in news for some time now. The Company also seems to have acknowledged the breach. As per this article in India Today, 31 million data principals might have been affected in the breach and the personal data is reportedly being sold online.

The the data has been accessed by an identity under the name xenZen who has also suggested that the data was sold for US $150000. The net price is as low as 38 paise per data set which is not realistic. The normal price for such data .

One indicative price list of data is as follows:

The type of data leaked in the Star Health breach is indicated as

• Full Name
• PAN No.
• Mobile No.
• Email
• Date of Birth
• Residential Address
• Insured Date of Birth
• Insured Name
• Gender
• Pre-existing Disease
• Policy Number
• Health Card
• Nominee Name
• Nominee Age
• Nominee Claim %
• Nominee Relationship
• Insured Height
• Weight
• BMI

The leak also indicates that the CISO of Star Health Management Mr Amarjeet sold the data but later tried to change the deal terms.

The hacker also invites journalists to contact him on his email for proof etc.

Data Breach is not new in India but what is strange in this instance is that the name of the CISO is given along with an indication that the management is also involved in the data breach.

There are several issues in this case which are beyond the scope of investigation by the Company itself. In fact the more company wants to investigate, it will vitiate the evidence in violation of law.

The value indicated is not realistic and hence there is a prima facie doubt that some body who wanted to frame the CISO and blame the company is involved in this data leak. In view of the doubts raised on the company and the CISO himself, an internal investigation is not reliable.

Further, the consideration involved is in US dollars and hence there is also a FEMA angle.

From all angles this is a case to be investigated by CBI and ED and extend to other employees of the Company as well as competitors of Star health Insurance who are the beneficiaries of this data leak.

The CERT In also has to start its investigation. However this investigation is beyond the scope of a single organization involved in Data Breach investigation.

We urge that CERT IN should file a complaint with CBI and ED to trigger an investigation , assist them in the investigation and find out the truth behind this data breach.

In the meantime, we re-iterate that the existence of “Proton Mail” kind of services and the dark web itself is the root cause for such crimes and the country as a whole should declare Proton Mail as a “Terror Outfit” and take up the investigation as a “Cyber Terrorism Case”.

There is an urgent need to completely ban Proton Mail in India and also ban the use of Tor browsers making it an offence to use them without license. The MHA should also look into this case and bring some fundamental changes to our legal system so that Cyber Crimes are not facilitated by the existence of dark web and its allies like the Proton Mail.

Naavi

Sri Ratan Tata has lived a full productive life which any body can be proud of. While we regret that his leadership would no longer be available to guide the Indian industry, it is our duty to remember and follow his vision and principles.

One of the notable observations about his career is his commitment to the good of the nation. He was an example for other industrialists and exhibited this commitment in no small measure when he took over Air India.

Naavi and FDPPI appreciate this spirit of working for the benefit of India and follow similar principles of indigenous approach to what we do whether it is DGPSI as a framework or C.DPO.DA. as a Certification.

We therefore would continue to remember him and dedicate one of our annual Privacy Awards we normally distribute during our annual flagship event “Indian Data Protection Summit 2024” (This year to be conducted on November 30 and December 1 at Bengaluru as a hybrid event), to “Commitment to National good”.

More details would be shared separately.

Naavi

Currently Cyber Insurance covers first party damage in case of any data breach. This covers cost of recovery of lost data, legal and forensic costs and perhaps some consequential damages such as third party liability claims.

In the post DPDPA scenario, there is a concern about the cost of the Administrative fine which could be substantial. It is a grey area whether this fine if any can be insured.

By the nature of the fine, it is levied because of the non compliance of law besides other reasons such as causing harm to the data principal. It is therefore difficult to provide coverage since in principle, insurance cannot protect and reward non compliance of law.

However, in most cases when fines are levied, the data fiduciary may claim compliance and it would be a matter of the regulator not agreeing that the measures taken were adequate enough. It would be a matter of debate whether there was “Reasonable” measures and “Due Diligence” on the part of the data fiduciary. It is possible that a breach was attributable to the action of a third party despite reasonable measures taken by the data fiduciary for compliance in good faith. It is like an automobile accident which occurs despite careful driving and not because of blatant violation of law such as driving in the one way street in the opposite direction or driving in a drunken state.

If automobile insurance as well as the law for punishment to drivers for rash and negligent driving can distinguish between what is rash and negligent and what is not, should there be a similar discussion on the fines levied for DPDPA non compliance?

In most cases, the order of the regulatory authority may specify the root cause and whether there was gross negligence or lack of food faith in the incident on the part of the data fiduciary. If so, should a “DPDPA Liability Insurance Policy” cover not only the cost of conducting investigation, legal defence , meeting the liability to the data principals but also the administrative fine (may be subject to a sub limit)?

The insurance industry needs to ponder over this.

On the part of Auditors FDPPI would like to offer

a) An Assessment of DPDPA readiness for an Insurance company to accept an insurance proposal

b) An assessment of DPDPA penalty liability when an incident occurs or an inquiry is ordered by the Data Protection Board.

These assessments can be structured for the needs of the Insurer and conducted at the instance of the insurance company.

They may be different from the assessment made as “DPDPA Gap Assessment” or “DPDPA Compliance implementation Assistance”.

Two days back, Californian Government signed a new law SB 1223 which recognized neuro rights as part of the Privacy Rights by defining Neural data as ‘Sensitive data” under CCPA.

With this California became the second state after Colarado (Refer here) to expand the scope of Privacy Act into Neuro Rights Protection.

The bills also suggest that it is possible to extend Neuro Rights by just tweaking the understanding of “Sensitive Data” within a Privacy law.

There is a concern in India that DPDPA 2023 does not recognize “Sensitive Data”. However, the definition of a “Significant Data Fiduciary” under DPDPA 2023 includes such data fiduciaries who process high volumes of “Sensitive Personal Data”. It does not require a legal definition to define “Neural Data” as “Sensitive”.

Hence any organization in India which is working on “Neuro Technology” will now have to be classified as “Significant Data Fiduciaries” and treated as such for compliance. The NIMHANAS type of organizations eminently qualify for such categorization along with all hospitals who may be involved in technologies that could read, store, manipulate or disclose neural data.

“Neural Data” represents the binary activity of the brain cells which is an electro mechanical exercise that builds up charges in a brain cell and when it crosses a threshold charge level, pushes the data to the next brain cell. This is a typical reflection of a binary activity where a built up charge beyond a threshold level represents the binary value of 1 while the value below the threshold level represents zero.

Hence without waiting for further changes in law, India can start protecting Neuro Rights within the current law unless there is any proviso inserted to exclude such data in the rules which is unlikely.

Naavi

also refer: https://neurorights.in/wp/

FDPPI is closely working with Cyber Law College to develop capacity of Data Protection Officers and Data Auditors.

In this direction, FDPPI being a Not for Profit Organization with an interest in developing the community interests, has decided to develop a set of “Master Trainers” in the immediate future at 20 major cities of the country who can conduct local physical training programs for C.DPO.DA. These Master trainers will be individual torch bearers of Privacy Training supported to the extent required by FDPPI/Cyber Law College.

Since FDPPI has introduced a “Cross Certification” program where by professionals trained by DSCI/IAPP/ISACA are provided privileged entry into the C.DPO.DA. examination ( with a concessional examination fee of Rs 6000/- plus GST as a launch offer applicable till October 17, 2024), it is decided that professionals trained by these “Master Trainers” are also allowed a direct entry to C.DPO.DA. at a differential pricing of Rs 10000/- plus GST (Subject to change).

One of the pre-requisites for being a Master Trainer is however that the entrepreneur should himself be a C.DPO.DA. qualified (at Level 3).

Level 1, 2 and 3 are three grades in C.DPO.DA. and Level 3 represents “Distinction”. Level 1 would be considered as the minimal Certification level for Privacy Professionals and Level 2 is recommended for Implementations consultants. The classification is based on different cut off points in the examination.

Since FDPPI/Cyber Law College is conducting the next program for C.DPO.DA. in Bengaluru on 27-29 of September 2024, it has been also decided to allow three persons aspiring to be “Master Trainers” to attend the training at 50% discount. (Net price would be Rs 20000/- plus GST 3600/- for three days). Persons coming from outside Bengaluru need to make their own arrangements for travel and stay. Interested persons may contact Naavi immediately. Since only three persons will be accommodated in this scheme, aspirants are requested to act quickly.

This will be purely optional for the trainees and if they are satisfied with the certifications given by the individual trainers there is no need to also try to get a C.DPO.DA. Certification. This is a voluntary offer from FDPPI and the other organizations whose Certifications are eligible for this cross certification are not required to provide any mutual counter offers.

With this Cross Certification Scheme and opening it out to Private Individuals, FDPPI is democratizing the training to persons with passion of training. This is an opportunity for every training professional or training company to develop their own training programs at their own pricing and enabling their candidates to opt for industry standard certifications. It is presumed that in the long term this will revolutionize the Certification mechanism and enable reduction of cost to the professionals aspiring for multiple Certifications.

Naavi