Navigating the Path to CyberPeace: Insights and Strategies

Featured Blogs

Who Owns Visibility in the AI Era? The Significance of IndiaMART v. OpenAI Judgment

June 19, 2026

Introduction
‍

The rise of artificial intelligence has transformed how individuals search for information, buy and compare products online. Unlike the traditional search engines like Google that presents the user with a set of links and directs users to websites, AI-powered systems provide synthesised answers and recommendations which means we don't have to click through every link to find what we are looking for, we simply have to ask an LLM and it provides recommendations based on our needs expressed through prompt. This development has raised important legal and commercial questions, one such question was addressed in the judgement of Indiamart Inter Mesh Limited v. Open AI Inc. and Others (2026 SCC OnLine Cal 5738) decided by HMJ Ravi Krishan Kapur of Calcutta High court on 20 May 2026. If an AI platform becomes a primary source of information, can a business demand inclusion in its responses? Is it a legal injury if the LLM omits a business? More fundamentally, how do the existing laws classify technologies that not only process information, but also generate new content? These were the questions that came before Calcutta High Court. Although the dispute arose from Indiamart’s complaint regarding visibility on ChatGPT search, the judgement explored beyond the disagreement between two private entities.

‍

The Dispute
‍

IndiaMart is one of India’s largest electronic business-to-business marketplaces since 1996, serving millions of buyers and sellers across India. They also have registered trademarks and their entire business depends on visibility on the internet considering the digitalisation of the market. Open AI launched ChatGPT search in October 2024, which is a feature that supplements AI responses with links to relevant web sources. Indiamart alleged that ChatGPT was not displaying links to their online platform in the same way that it displayed links to other competing services or individual sellers. A major grievance raised by Indiamart was that ChatGPT allegedly bypassed IndiaMart market listings by directing users to sellers’ individual websites while continuing to provide platform level links for other competing platforms. Hence, they contended that this practice diverted users away from their platform and negatively affected their business interests. The company argued that such exclusion amounted to discriminatory treatment and resulted in economic harm, diluted its trademarks and amounted to disparagement. They alleged that it violated their rights under article 14, 19, 21 under the constitution and rights under IT Act and IT Rules also. When IndiaMart sought an explanation from OpenAI, the company stated that its decision was influenced by the inclusion of IndiaMart in the United States Trade Representative (USTR) Review of Notorious Markets for Counterfeiting and Piracy 2024, a U.S. government report that identifies online and physical marketplaces alleged to facilitate intellectual property infringements. IndiaMart challenged this justification, arguing that the USTR report has no statutory or binding force in India. It further alleged selective discrimination, pointing out that several other platforms featured on the same USTR list including DHGate, Pinduoduo, Shopee, and Taobao continued to remain accessible through ChatGPT-generated responses. Consequently, IndiaMart approached the Calcutta High Court seeking interim relief directing ChatGPT to display and provide access to IndiaMart links in its responses.

‍

ARGUMENTS BEFORE THE COURT

‍

IndiaMart's contentions: They argued that ChatGPT, because its search feature, performs the role of an "intermediary" within the meaning of Section 2(1)(w) of the IT Act and is therefore required to comply with the obligations imposed under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. Relying on Rule 3(1)(n), IndiaMart argued that an intermediary cannot engage in discriminatory treatment of platforms or selectively restrict access to information. IndiaMart further maintained that users have a right to access information relating to its platform and that the omission of IndiaMart links from ChatGPT's responses violated this interest. They alleged violation of Articles 14, 19, and 21 of the Constitution, along with the broader principle of a user's "right to know", to argue that OpenAI owed an obligation to display IndiaMart listings in response to relevant queries. In addition, IndiaMart alleged that the exclusion of its links caused commercial harm, diluted its trademarks, amounted to disparagement, and constituted an unfair trade practice that adversely affected its business and reputation.

OpenAI's contentions: OpenAI asserted that IndiaMart had no legally enforceable ‘Right to visibility’ on ChatGPT. They argued that neither contract, statute, nor constitutional law imposed any obligation on OpenAI to display, prioritise, or recommend IndiaMart links in response to user queries. In the absence of any recognised legal right, there could be no actionable injury and therefore no valid cause of action. OpenAI also challenged the classification of ChatGPT as an "intermediary" under the Information Technology Act, 2000. According to OpenAI, ChatGPT does not merely host, transmit, or facilitate access to third-party content but also generates responses through its large language model (LLM) and therefore functions more closely as an "originator" than an intermediary. Consequently, the obligations applicable to intermediaries under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, including those relied upon by IndiaMart, were inapplicable. With respect to the USTR Notorious Markets List, OpenAI submitted that its reliance on the report formed part of its internal risk-management and business policies. Such decisions, it argued, were matters of private commercial judgment and not ordinarily subject to judicial review. OpenAI further pointed out that IndiaMart had also previously blocked ChatGPT from accessing and crawling its website that weakened the company's demand for greater visibility within ChatGPT-generated responses.

Court’s decision: The court rejected Indiamart's claim that they were entitled to be displayed in ChatGPT searches. The court emphasised the autonomy of private businesses, the court held that the right to carry on trade and business is "inviolable" and that no law can compel one private entity to operate their platform for the benefit of another, which is based on foundational economic philosophy of laissez faire. Unless there is a contractual, statutory or constitutional obligation, a platform has no duty to the other platform to promote or advance their economic interest. Applying this principle, the court found no such duty or “vested legal right” that entitled IndiaMart’s visibility on ChatGPT. The court reasoned that even if users possess the ‘right to know’, Indiamart could not convert that interest into an enforceable claim under article 19(1)(g) or other legal provision. The court looked at the dispute as one arising from commercial disadvantage rather than violation of any legally protected right. Although the reduced visibility may have had economic consequences, economic harm does not by itself create a cause of action.

The court also took into consideration whether ChatGPT should be classified as an intermediary under Section 2(1)(w) of the Information Technology Act, 2000 or as an originator under Section 2(1)(za). This was an important distinction, because the intermediaries can claim safe harbour protection under section 79 of the IT act, but the originators cannot. The court expressed a preliminary view that ChatGPT is generative capabilities, place it closer to an originator than an intermediary because, unlike conventional search engines, which identify and rank existing information, Generative AI systems, analyse the data and produce new output based on algorithms, which is in response to the user’s prompt. The Court also referenced the NITI Aayog National Strategy for Artificial Intelligence (pages 7 to 12) to support its observations that ChatGPT does not merely store, host or transmit information, it can produce essays, research material, code, creative writing, and other forms of content that did not previously exist in that exact form, hence extending beyond the conventional understanding of an intermediary. The court also recognised that it is a vexed issue and remains unsettled because AI systems operate in response to users instructions and do not function independently, which is why the court refrained from providing a definitive classification and acknowledged that the question may ultimately require legislative clarification as well.

In addition to this, the Court took the view that the IndiaMart’s grievances did not amount to an Intellectual property dispute, as they found no trademark infringement or dilution because any reference to the "IndiaMart" mark was merely descriptive and did not constitute commercial use "in the course of trade" under Section 29(4) of the Trade Marks Act. IndiaMart also hadn’t demonstrated any false or misleading use of its trademark.

Similarly, the Court found that claims of disparagement, trade libel, and injurious falsehood were unsustainable because such claims require the publication of a false statement that harms reputation and since ChatGPT had not published any derogatory statement about IndiaMart, the mere omission of links could not amount to disparagement or libel. The Court relied on Tech Plus Media v. Jyoti Janda, that allegations of unfairness or copyright infringement must be supported by specific pleadings and evidence.

Beyond the immediate dispute, the judgment shed light on the growing difficulty of applying legal categories created for an earlier internet era to generative AI systems. The Information Technology Act was enacted at a time when internet regulation focused primarily on websites, service providers, and electronic communications and therefore existing classifications may not adequately address the hybrid nature of contemporary AI technologies. The Court acknowledged OpenAI's concern that granting IndiaMart's request could trigger floodgates of litigation on similar claims from businesses dissatisfied with AI-generated visibility, however, it clarified that such concerns cannot outweigh genuine legal claims or fundamental rights. The Court suggested that legislative intervention may eventually be necessary.

‍

Conclusion
‍

This judgement not only addressed the visibility issue in AI generated responses, but also whether visibility itself can become a legally protected interest in AI-driven searches? As more and more users rely on AI generated output for their preference rather than traditional search engine output, the power to decide what information is displayed and what is not will eventually become economically significant. The Calcutta High Court through this judgement declined to create any such right through judicial interventions and also highlighted that the existing legal framework is not adequately equipped to address the novel challenges posed by generative AI.

‍(This blog is based on the judgment in Indiamart Inter Mesh Limited v. Open AI Inc. and Others, 2026 SCC OnLine Cal 5738, decided on May 20, 2026 by the Calcutta High Court, and related reporting by LiveLaw and SCC Times.)

‍

References
‍

‍

Who Controls Encrypted Conversations? The Battle Over Telegram and Digital Rights

June 18, 2026

Introduction
‍

In June 2026, the Government of India temporarily restricted access to Telegram amid concerns that the platform had been used to facilitate examination related malpractice, including the alleged circulation of leaked question papers during the NEET UG re examination. The move reignited a familiar debate about the responsibility of digital platforms for unlawful activities carried out through them.

Critics of such restrictions raise a fundamental question: if a traffic accident occurs on a road, do we shut down the road? If theft takes place inside a shopping mall, do we close the entire mall? By the same logic, is it reasonable to block a communication platform because some individuals misuse it? These questions lie at the heart of a broader conflict between state interests in maintaining public order and the protection of digital rights, privacy, and freedom of communication in an increasingly interconnected world.

The controversy surrounding Telegram therefore extends beyond a single examination or messaging application. It raises a deeper and more pressing question: who should bear responsibility for illegal acts committed through encrypted digital platforms, and where should the law draw the line between effective enforcement and the preservation of fundamental digital freedoms?

Beyond mere communication for millions of students in India, Telegram is a classroom in the digital sense, an archive for their notes, practice papers, lecture recordings, and community groups that hundreds of millions of candidates refer to every single day. Therefore, why on a routine day in June 2026 did the messaging app top every other channel? Temporary internet restriction on the platform had become necessary to stop examination-related malpractice like leakage of question papers and was temporarily suspended, with reports suggesting that this move by the government was on the occasion of the NEET-UG re-examination.

This ban once again brings up a bigger question that cannot be contained within one particular examination. When has it become okay to hold a communication platform responsible and accountable for illegal acts committed over it? Or are the perpetrators solely to blame, and the service can be prohibited? Ultimately, where is the line drawn between public interest, law enforcement, and digital rights and privacy?

‍

End-to-End Encryption: Architecture and Benefits
‍

At the heart of these discussions of Telegram and other apps lies a technology referred to as "end-to-end encryption" or "E2EE." Quite literally, it means a message is locked with cryptography on the sender's device and can only be unlocked by the intended recipient. Not even the tech platform running the communication app can decipher it for everyone else; it just looks like random gibberish.

‍

The Process
‍

This kind of modern communication relies on public key cryptography. Each person has a public key they can share with anyone and a private key that stays only on their devices. When they send you a message, it is scrambled with crypto that can be unlocked by only your private key. WhatsApp and Signal, for example, use the Signal Protocol, which features "perfect forward secrecy" and is designed to protect communications from ever being unlocked even if one key is compromised. Telegram's approach is a bit unique. By default, Telegram messages aren't encrypted with end-to-end crypto; this only comes via an optional feature called "Secret Chats," a key difference in the regulatory debate.

‍

The Dark Side: Crime, Misuse, and the Moderation Dilemma

‍

The very features that make end-to-end messaging popular among everyday people are privacy, speed, anonymity, and mass reach which also make end-to-end messaging popular among criminals. That, unfortunately, is the catch for policymakers globally: The technology designed to protect innocent users is also the technology that facilitates criminal activity.

‍

3.1 Criminal Abuse

Telegram, in particular, has frequently come under fire for its role in hosting a spectrum of criminal activities, most notably in the recent controversy in India regarding NEET-UG 2026 examination papers where channels allegedly advertised leaked question papers for enormous sums, convincing desperate candidates. In these instances, messages could be altered or deleted using Telegram’s message editing feature, fabricating evidence of prior leaks. However, this extends to illicit marketplaces, drug trafficking, financial fraud, money laundering, and distributing other prohibited content. Telegram's usage in disseminating extremist propaganda and aiding criminal organizations is also frequently cited, leading to bans or restrictions in countries ranging from Brazil to Nepal to Somalia to Vietnam.

‍

3.2 The Moderation Dilemma

But the difficulty is not just with misuse; it’s also about effective moderation. Moderation, however, requires content transparency. Strong encryption is built to obscure just that. Many end-to-end messaging services like Signal and WhatsApp emphasize that even if they wanted to, they would have been able to decipher the content of a user’s message due to their architecture. Telegram has been in scrutiny for years due to its limited cooperation with law enforcement agencies because its default chats are not completely end-to-end encrypted, though there has been an attempt by Pavel Durov, the platform’s founder, to increase cooperation following his 2024 arrest in France.

This gives policymakers the following challenge: How can governments require increased access to fight crime without forcing tech companies to weaken security for everyone? As cryptographers point out, a specific "backdoor" intended to allow access to law enforcement officials can be easily exploited by hackers, foreign governments, and any other actor with nefarious intent.

‍

Comparison of Regulatory Approaches Worldwide

‍

4.1 Authoritarian Countries' Responses

‍

China, for instance, has had the app blocked as part of its strategy to control access to the internet since 2015, and Iran did so in 2018 when the app was used to help organize protests against the government. An infamous Russian bid to block Telegram in 2018 turned into a cautionary story. Trying to censor the service disrupted the IPs of millions of computers, including significant services like those run by Amazon and Google. The move was met by a surge of users turning to VPNs to get access. It’s an expensive, disruptive, and incomplete form of censorship.

‍

4.2 Democratic Countries' Approaches

‍

Democratic jurisdictions generally prefer targeted interventions. Telegram was suspended in Brazil in 2022 and 2023, though again, only in response to a judge’s order in relation to particular investigations, and was lifted when it came into compliance. The EU’s approach has been to build on an established approach of regulation by use of a broader legislative framework, including the Digital Services Act and the Digital Markets Act, aimed at platform liability rather than outlawing encryption outright.

Meanwhile, the proposed scanning of encrypted communications has run into strong judicial headwinds, with the European courts stressing the danger of backdoors to privacy.

‍

4.3 The United Kingdom Approach

‍

The UK offers a middle way. With its Investigatory Powers Act, the government can oblige tech companies to collaborate in legitimate investigations. But this came to a head earlier this year with the case of Apple and the government's attempts to force it to unlock encrypted iCloud backups. Apple not only refused to reduce its encryption but also decided instead to disable some of its features for British users. This has created a problem for democracies across the world: how to balance access for investigators against the need to maintain the security that makes our systems safer.

‍

Judicial and Legislative Perspectives: India and Beyond

‍

In the Indian context, to have a perspective about the legal frameworks concerning content moderation, let’s explore some of the foundational decisions from the Supreme Court. Three decisions have laid the building block for digital rights laws: the first being Shreya Singhal v. Union of India (2015), where Section 69A of the IT Act, 2000, was upheld, but only by laying rigorous conditions on the review process and chance of challenging the said decision. Another important decision in this sphere is Justice K.S. Puttaswamy v. Union of India (2017) which stated that the right to privacy is fundamental in nature under Article 21 of the Constitution and stipulated the constitutional requirements of legality, legitimacy, and proportionality against the state’s interventions in fundamental rights. The most recent important case law to consider, in this context, would be Anuradha Bhasin v. Union of India (2020) which set certain limitations, such as any internet shut-downs or orders have to be temporary, proportional, and have scope for appeal. Further, the Supreme Court demanded transparency around any and all orders of blocking.

These principles of proportionality and legal limitations are highly pertinent to the Telegram issue, especially since Section 69A confers powers to block information in case of concerns about public order, national security, etc., but activists often cite this power to target specific content rather than entire platforms like Telegram. The ban on Telegram in June 2026 and disabling of message editing will force authorities to justify not only their statutory authority but also the need for proportionate means.

These aspects are amplified by IT Rules, 2021, which mandate that some instant messaging platforms may require identification of the ‘first originator’ of messages, and the Digital Personal Data Protection Act, 2023, to protect digital personal data by ensuring it does not undermine national security exceptions to this end.

Moreover, the use of encryption to ensure secure and private communications is becoming an important point of legal discourse globally. Recently, the European Court of Human Rights in Podchasov v. Russia (2024) held that mandating decryption on devices as a tool of investigative power constituted a disproportionate interference with an individual's right to privacy implying that while states may indeed have authority to regulate communication and digital services, any such measures limiting the scope of encryption will have to meet strict requirements of legality, necessity, and proportionality to be legally justifiable.

‍

Constitutional Validity of the Ban

‍

The government's case for a constitutional ban on Telegram rests upon its ability to satisfy the proportionality framework established by Puttaswamy and Anuradha Bhasin.

Legitimate aim: The state's strong suit. This is the government's best argument. Protection of the integrity of NEET-UG, a high-stakes test with close to 2.4 million students, can indeed be a legitimate state objective. Given that there is evidence of channels that allegedly were involved in selling leaked question papers, the action is presumably justifiable under section 69A for preventing the incitement or occurrence of public disorder or preventing cognizable offenses.
Necessity: The National Testing Agency (NTA) itself admitted that localized removal of suspicious accounts on Telegram had already mitigated the risks, while Telegram insisted that it had independently taken down numerous channels. The fact that the block affected more than 150 million users in India, where the medium is widely used for personal communication and is also utilized on other platforms like WhatsApp, Discord, and Instagram to a similar or higher extent, raises the responsibility to justify a strict platform-wide ban. Moreover, there is a significant legal question regarding the state’s authority under section 69A to direct Telegram to disable its message-editing capability.
Proportionality and process: The block, even though it was temporary and intended to ensure fairness in the examination system, severely undermined legitimate uses of the platform by students who used it to share educational materials and organize study groups. Moreover, the opaqueness around the section 69A order is itself hard to reconcile with the transparency requirements set out in Anuradha Bhasin.

Thus, while the objectives of preventing exam fraud may be legitimate, the necessity and proportionality of single platform-wide bans remain highly suspect under Indian constitutional law.

‍

Policy Recommendations and the Path Forward

‍

The Telegram controversy points to the need for a better balancing act in platform governance in India. Firstly, instead of blanket platform shutdowns, action should target specific channels, bots, or URLs, as may be the case. Secondly, any attempt to dictate changes to features, such as disabling message editing, should be based on specific statutory provisions, not an expansive reading of Section 69A. Furthermore, there is a dire need for increased transparency; blocking orders must state the justification for the order, what is being blocked, and for how long, as far as possible. In the long run, stricter cross-border cooperation via streamlined MLATs, or through the appointment of local legal representatives by foreign platforms, would facilitate easier enforcement. Ultimately, all major blocking decisions must be accompanied by proportionality assessments. Lastly, India must resist pressure to provide access to encryption backdoors; while this might ease investigative burdens, doing so would severely jeopardise the cybersecurity of India, its businesses, and citizens.

‍

Conclusion

‍

The Telegram ban is an example of the tricky equilibrium between protection of public interest and protection of digital liberties in our hyper-connected world. While the intent to counter exam fraud is justifiable, a blanket ban on any platform has much broader implications on questions of necessity, proportionality and transparency. India has a well-developed constitutional and legal framework to deal with this issue already, and the challenge will be to see if those powers are used appropriately.

‍

References

‍

Cases:

‍

Shreya Singhal v. Union of India (2015) 5 SCC 1 — Supreme Court of India
Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 — Supreme Court of India (Nine-Judge Bench)
Anuradha Bhasin v. Union of India (2020) 3 SCC 637 — Supreme Court of India
Podchasov v. Russia, European Court of Human Rights (Application No. 33696/19, February 2024)
Apple Inc. v. United States (In re Search of an Apple iPhone, C.D. Cal. 2016)
Telegram Messenger Inc. v. Union of India & Anr., Delhi High Court (June 2026) — Sub judice

‍

Legislation & Rules:

‍

Information Technology Act, 2000 (India) — Sections 69A, 79
IT (Procedure and Safeguards for Blocking Access to Information by Public) Rules, 2009
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Digital Personal Data Protection Act, 2023 (India) & DPDP Rules, 2025
EU Digital Services Act, 2022 (Regulation 2022/2065)
EU Digital Markets Act, 2022 (Regulation 2022/1925)
EU Child Sexual Abuse Regulation (CSAR) Proposal — In Trilogue, June 2026
UK Investigatory Powers Act, 2016

‍

Policy Sources:

‍

Internet Freedom Foundation, Statement on Telegram Block, 16 June 2026
European Commission, ProtectEU Security Strategy, June 2025
MeitY Section 69A Blocking Order re: Telegram (June 2026)
NTA Press Release on NEET-UG 2026 Re-Examination, 16 June 2026

‍

Who Owns Visibility in the AI Era? The Significance of IndiaMART v. OpenAI Judgment

June 19, 2026

Introduction
‍

‍

The Dispute
‍

‍

ARGUMENTS BEFORE THE COURT

‍

Conclusion
‍

‍

References
‍

‍

Who Controls Encrypted Conversations? The Battle Over Telegram and Digital Rights

June 18, 2026

Introduction
‍

‍

End-to-End Encryption: Architecture and Benefits
‍

‍

The Process
‍

‍

The Dark Side: Crime, Misuse, and the Moderation Dilemma

‍

3.1 Criminal Abuse

‍

3.2 The Moderation Dilemma

‍

Comparison of Regulatory Approaches Worldwide

‍

4.1 Authoritarian Countries' Responses

‍

4.2 Democratic Countries' Approaches

‍

Meanwhile, the proposed scanning of encrypted communications has run into strong judicial headwinds, with the European courts stressing the danger of backdoors to privacy.

‍

4.3 The United Kingdom Approach

‍

Judicial and Legislative Perspectives: India and Beyond

‍

Constitutional Validity of the Ban

‍

The government's case for a constitutional ban on Telegram rests upon its ability to satisfy the proportionality framework established by Puttaswamy and Anuradha Bhasin.

Legitimate aim: The state's strong suit. This is the government's best argument. Protection of the integrity of NEET-UG, a high-stakes test with close to 2.4 million students, can indeed be a legitimate state objective. Given that there is evidence of channels that allegedly were involved in selling leaked question papers, the action is presumably justifiable under section 69A for preventing the incitement or occurrence of public disorder or preventing cognizable offenses.
Necessity: The National Testing Agency (NTA) itself admitted that localized removal of suspicious accounts on Telegram had already mitigated the risks, while Telegram insisted that it had independently taken down numerous channels. The fact that the block affected more than 150 million users in India, where the medium is widely used for personal communication and is also utilized on other platforms like WhatsApp, Discord, and Instagram to a similar or higher extent, raises the responsibility to justify a strict platform-wide ban. Moreover, there is a significant legal question regarding the state’s authority under section 69A to direct Telegram to disable its message-editing capability.
Proportionality and process: The block, even though it was temporary and intended to ensure fairness in the examination system, severely undermined legitimate uses of the platform by students who used it to share educational materials and organize study groups. Moreover, the opaqueness around the section 69A order is itself hard to reconcile with the transparency requirements set out in Anuradha Bhasin.

Thus, while the objectives of preventing exam fraud may be legitimate, the necessity and proportionality of single platform-wide bans remain highly suspect under Indian constitutional law.

‍

Policy Recommendations and the Path Forward

‍

Conclusion

‍

References

‍

Cases:

‍

Shreya Singhal v. Union of India (2015) 5 SCC 1 — Supreme Court of India
Justice K.S. Puttaswamy v. Union of India (2017) 10 SCC 1 — Supreme Court of India (Nine-Judge Bench)
Anuradha Bhasin v. Union of India (2020) 3 SCC 637 — Supreme Court of India
Podchasov v. Russia, European Court of Human Rights (Application No. 33696/19, February 2024)
Apple Inc. v. United States (In re Search of an Apple iPhone, C.D. Cal. 2016)
Telegram Messenger Inc. v. Union of India & Anr., Delhi High Court (June 2026) — Sub judice

‍

Legislation & Rules:

‍

Information Technology Act, 2000 (India) — Sections 69A, 79
IT (Procedure and Safeguards for Blocking Access to Information by Public) Rules, 2009
IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021
Digital Personal Data Protection Act, 2023 (India) & DPDP Rules, 2025
EU Digital Services Act, 2022 (Regulation 2022/2065)
EU Digital Markets Act, 2022 (Regulation 2022/1925)
EU Child Sexual Abuse Regulation (CSAR) Proposal — In Trilogue, June 2026
UK Investigatory Powers Act, 2016

‍

Policy Sources:

‍

Internet Freedom Foundation, Statement on Telegram Block, 16 June 2026
European Commission, ProtectEU Security Strategy, June 2025
MeitY Section 69A Blocking Order re: Telegram (June 2026)
NTA Press Release on NEET-UG 2026 Re-Examination, 16 June 2026

‍

ILO Adopts World's First Gig Economy Treaty | A Landmark in International Labour Law

June 17, 2026

Introduction

‍

Did you know that millions of workers today earn their livelihood through digital platforms such as Uber, Lyft, Deliveroo, Amazon Flex, Swiggy, and Zomato? The gig economy refers to a labour market in which individuals earn income through short term, temporary, task based, or freelance work arrangements rather than traditional long term employment. Most gig work is facilitated through digital platforms such as Uber, Lyft, Deliveroo, Amazon Flex, Swiggy, and Upwork, which connect workers directly with customers seeking specific services. While the gig economy has created unprecedented opportunities for flexible work, it has also exposed workers to challenges such as insecure employment, lack of social security, unfair pay, and algorithmic control. To address these concerns, the International Labour Organization adopted Convention No. 193, the world's first binding international treaty dedicated to platform workers. The Convention marks a significant step towards ensuring decent work in the digital age and is expected to guide nations in building stronger legal and social protection frameworks for the rapidly expanding gig economy.

‍

First Gig Economy Treaty at Glance
‍

On June 12, 2026, the course of global labor governance took a decisive turn when, at its 114th International Labour Conference in Geneva, the ILO finally ratified the Decent Work in the Platform Economy Convention (ILO Convention No. 193) with a vote of 406-8-36. This first-ever binding instrument setting labor standards for digital platform/gig workers represents the product of a lengthy multi-year debate leading to an international understanding that labor law itself had to be redefined to apply to the digital age. The Convention sought to fill a regulatory gap in which "corporation power, algorithmic governance, work informality, and workers’ rightlessness defined the space."

‍

The Genesis: How the Convention Came to Be

‍

The negotiations of ILO Convention No. 193 were long, complex, and controversial. The systematic ILO attention on the gig economy was started during the beginning of the 2010s as on-demand app-based models provided by Uber, Lyft, Deliveroo, Amazon Flex, etc., began to transform the labor market fundamentally. The problem concerned is mass misclassification of workers.

Labeling platform workers as "independent contractors," as opposed to "employees," allows digital platforms to escape many standard labor law obligations such as minimum wage standards, social security benefits, health and safety standards, and the right to organize and bargain collectively.

Calls for international action escalated with the growth of the gig economy. 435 million people in the world were active in online gig work as of 2023, based on the World Bank Report. The platform work was added to the agenda of the ILO Governing Body in 2023. In 2024, a questionnaire was sent to member States and social partners and compiled into Report V(2): Realizing decent work in the platform economy (February 2025).

A decisive turning point occurred at the 113th International Labour Conference in June 2025 when, despite objections from employer representatives and governments like the United States, India, and Switzerland, delegates agreed to adopt both a binding Convention and a Recommendation on the issue.

A Standard-Setting Committee then produced a draft instrument throughout 2025 and early 2026. The committee's text was adopted by the committee on June 11, 2026, and by the conference plenary the following day. Civil society groups, including Privacy International and Human Rights Watch, played a role in the process through their recommendations regarding algorithmic governance, data privacy, and inclusive coverage.

‍

Scope and Definitional Framework

‍

The most important and contentious aspect of the Convention is its scope. The text defines "digital labour platforms" as being covered, as well as "all digital platform workers… whether in the formal or informal economy. "It is designed this way precisely because previous attempts at regulating platforms, such as the 2024 EU Platform Work Directive, which was weakened considerably by the Council's final approval, were narrow and open to carve-outs. "Digital platform worker," according to Convention No. 193, is defined as "a person who is in employment or engaged in work for the provision of a service organised and/or mediated by a digital labour platform." It makes no distinction regarding employee status, thereby evading the definitional trap that allowed platforms to deny responsibility by defining workers as self-employed. The platforms covered in the Convention include location-based (food delivery, ride-hailing, domestic care, and construction services) and online/cloud-based platforms (data annotation, content moderation, creative freelancing, and software development).

‍

Key Substantive Provisions

‍

Fundamental Principles and Rights at Work :Convention 193 requires each state that ratifies it to make arrangements to "respect, promote, and realise" these fundamental principles and rights at work, which under the 1998 ILO Declaration were identified as freedom of association and the effective recognition of the right to collective bargaining; the elimination of forced or compulsory labour; the abolition of child labour and the elimination of discrimination in employment and occupation. The question of collective bargaining rights is especially important since digital platforms have not in the past been willing to accept unions and bargaining processes, claiming that since those who work on the platform are classified as independent contractors, they do not have the right to bargain collectively.

Fair Pay and Parity of Treatment :The Convention enshrines equal pay and treatment for gig workers: "not less favorable conditions than those offered to workers of the same employment status classification." This has the aim of remedying the two-tier system maintained by a number of digital platforms, where workers performing the equivalent job role of employees are provided with considerably lower remuneration, lacking the benefits, stability, and protection afforded to employees under statutory labor law.

Transparency and Algorithmic Accountability:One of the most innovative features of Convention 193 is its attempt to tackle algorithmic management. Digital platforms must supply information about the terms of the working relationship in a manner that is "timely, verifiable, and easily accessible and comprehensible" and, "in all cases prior to any significant changes," must disclose how automated systems allocate work, set pay, and determine termination decisions. Civil society organisations, such as Privacy International and Human Rights Watch, sought to make algorithmic control, including human oversight over automated decisions to impose disciplinary sanctions, legally binding. While the final provision fell short of doing so, it represents a new standard for algorithmic transparency in international labour law.

Occupational Safety and Health :Each member state will be required to take steps to prevent occupational accidents, diseases, and injuries "affecting platform workers." For location-based gig workers, such as delivery and ride-hailing drivers who are repeatedly placed in hazardous and unstable work environments, this provision is vital in addressing what is frequently referred to as a 'silent crisis' within the platform economy, as workers are often ineligible for statutory workplace injury coverage and compensation schemes.

Social Security Access:Possibly the most significant structural reform the Convention seeks to bring about, gig workers will have a right to access social security (including medical coverage, sick pay, and retirement and maternity/parental/sick benefits), which they have been able to bypass on the grounds of independent contractor status. For decades, digital platforms have lowered labor costs by externalizing the costs of social insurance onto gig workers themselves or public welfare systems. Convention 193 attempts to render that strategy illegal under international law.

Protection for migrant and refugee workers :There are provisions protecting migrant and refugee platform workers and ensuring rights and protection throughout the life cycle of work, covering recruitment to employment and providing protection against discrimination. Migrant workers are over-represented among those employed in low-paid and informal gig work, where they face the highest risks of exploitation and deteriorating work conditions.

Dispute resolution: Convention 193 establishes for platform workers the right to effective and impartial complaint and dispute resolution procedures as well as appropriate remedies, meaning when a country ratifies and domesticates the convention, workers will be empowered to pursue direct claims against digital platforms, overcoming the traditional obstacles placed in the way of such action.

‍

Enforcement Architecture and Its Limitations

‍

Despite the convention's potential, it is subject to key difficulties in implementation. The ILO does not have the enforcement power of the World Trade Organization, and simply ratifying a Convention does not automatically give domestic law effects. Countries must integrate the Convention into their national legislation, and ratifying members are not bound to implement it until 12 months after the Convention is ratified, which has also required two ratifications for entry into force. The Convention has optional provisions excluding the scope, where the argument is for the need of flexibility in the varied labour markets. While the International Trade Union Confederation, in reaction to the exclusions, has argued that large numbers of workers could be out of its protection, the countries that resort to the exceptions have to give a justification for this practice. The enforcement of the Convention is largely a matter of political will. Countries that, like the United States, voted against the Convention, will certainly choose not to ratify and implement it in their own legal system, leaving the gig workers out of its scope.

‍

Geopolitical and Comparative Context

‍

Convention No. 193 did not arise in a vacuum. There has been a trend of national governments regulating platform work in various ways. Spain's Riders' Law (2021) provided for a legal presumption of employment for delivery riders, while the UK Supreme Court ruled that Uber drivers are workers in 2021, entitling them to minimum wage and holidays. The French Constitutional Council (2020) found platform worker charter clauses consistent with rights. Some Indian states have promoted registration for gig workers for social security purposes (though national legislation is still needed). Convention No. 193 standardises these varied efforts through international normative agreement and particularly helps lower-income states lacking capacity or power against global platforms.

‍

Conclusion

‍

While ILO Convention No. 193 represents a momentous milestone for platform workers, the true impact of the Convention rests on ratification, domestic legislation, and judicial enforcement, alongside consistent vigilance on the part of the trade unions and civil society. Its most significant accomplishment to date is the establishment of a new international norm: for the first time, it establishes under international law that the labor rights of platform and gig workers are state responsibilities, not discretionary private undertakings by companies, a fact made urgently necessary by the growing strength of platform power.

‍

References

‍

The Gentlemen and the Architecture of Modern Ransomware | A Case Study in Cybercrime, Attribution, and Geopolitical Impunity

June 16, 2026

Introduction

‍

In today’s cybersecurity landscape, ransomware has emerged as one of the most significant and rapidly growing cyber threats. What began as attacks carried out by individual hackers has evolved into a highly organised criminal enterprise, with groups operating through structured business models and global networks. The emergence of The Gentlemen ransomware group reflects this transformation, demonstrating how modern threat actors can quickly expand their operations and target organisations across multiple sectors. Their rise highlights the increasing sophistication of ransomware campaigns and the growing challenges faced by organisations in defending against them. The attribution of the group's administrator to an identified individual in Izhevsk, Russia, provides a valuable lens through which to examine three interconnected developments: the maturation of ransomware-as-a-service (RaaS) business models, the inherent operational security (OPSEC) weaknesses that emerge over the course of cybercriminal careers, and the geopolitical environments that enable such actors to operate with relative impunity. Together, these dynamics illustrate the industrialisation of modern cybercrime.

‍

The Industrialisation of Ransomware-as-a-Service

‍

The remarkable rapid rise of The Gentlemen is impossible without discussing the maturation of ransomware-as-a-service (RaaS). RaaS systems utilize network intrusion experts as affiliates who conduct networks intrusions and secure access in exchange for a cut of the total ransoms paid, while a core group builds and maintains the ransomware framework itself. Although Reveton, one of the earliest Raas providers, can be credited with bringing early iterations of RaaS to fruition in 2012, the potential scale was truly evident in the mid-2020s. By 2025 it was estimated that there were over 100 active ransomware gangs operating; this proliferation is the direct result of the franchise-like system, which has lowered the barriers to entry for cybercrime.

The marketplace surrounding RaaS is intensely competitive, and this is clearly exemplified in the business structure of The Gentlemen: while many of the top ransomware groups provide an 80/20 profit share (with the majority of the profit going to the affiliates), The Gentlemen has an exceptionally profitable 90/10 split (affiliates keep 90% of the profit share) for affiliates, likely to draw experienced operators away from their rivals given recent decreases in victim willingness to pay and corresponding increases in the incentives RaaS platforms are required to offer.

The operational efficiency of the group is representative of a successful enterprise. They attack vulnerable internet-facing VPNs and firewalls and generally complete the network encryption within a matter of hours, leaving defenders with very little time to respond, as confirmed by Check Point Software, a renowned cybersecurity vendor.

Additionally, PRODAFT reports that the administrator of The Gentlemen, known by the alias Zeta88 (previously known as Hastalamuerte), directly provides affiliates with SSL VPN credentials, often obtained through brutal force attacks or their own private leaked databases, indicating an unusually high level of vertical integration for RaaS groups.

‍

AI as a Force Multiplier in Ransomware Development

‍

A particularly significant aspect of the Hastalamuerte case is PRODAFT's finding that the administrator employs artificial intelligence to develop and maintain ransomware, support associated tooling, and assist post-exploitation operations. This reflects a broader trend observed across the 2025–2026 threat landscape, where AI has increasingly lowered the capability threshold for participation in organised cybercrime. Researchers have documented its role in automating stages of intrusion, accelerating malware development cycles, and simplifying the maintenance of malicious infrastructure. These capabilities have been leveraged by both nation-state actors and criminal enterprises.

The trajectory of Hastalamuerte is especially illustrative. Cybersecurity Forum posts during 2019-2020 depict a hacker who is fairly novice at fundamental penetration testing procedures. A subsequent emergence as the operator of a top-tier ransomware-as-a-service operation indicates that AI-assisted development may be responsible for dramatically reducing the skill level and time necessary to create a successful criminal enterprise in cyberspace. The evolution of these tools should make the route from novice forum user to accomplished ransomware operator more attainable for a wider array of perpetrators in the future.

‍

The OPSEC Paradox: How Cybercriminals Leave a Trail

‍

The attribution of Hastalamuerte's identity by researchers from Intel 471, Flashpoint, and Constella Intelligence demonstrates the effectiveness of modern open-source and commercial intelligence methodologies. A forum registration traceable to an IP address from Izhevsk, Russia linked a Protonmail address, which linked to an Apple account, a GitHub profile, a Telegram handle, a Russian phone number, and finally to a 36 year old marketing professional named Alexander Andreevich Yapaev who was also living in Izhevsk. Investigators did not use an advanced capability in their attribution, but rather a simple OPSEC mistake of consistently reusing credentials. Every username and email address and every phone number creates a linkage between disparate data points, eventually building into a real-world persona.

It has also come out in the forum discussion that while training for a penetration testing course in 2020, Hastalamuerte displayed the kind of inexperience that a novice would display in traceable, recorded fashion to intelligence databases. It's an example of a broader rule about attribution; attacker mistakes provide the most value. With Russians the lack of apparent consequences may contribute to a lack of need to maintain tight OPSEC from the start.

‍

The Russian Safe Haven: Conditional Impunity and Its Limits

‍

Yapaev's base in Izhevsk is emblematic of the geostrategic situation that has allowed Russian cybercriminality to prosper. Security researchers routinely label Russia's policy as one of "controlled impunity," where the cybercriminality directed at foreign entities is ignored or implicitly condoned, while that directed at Russian interests will prompt a law enforcement response. This constitutes what has been called a "managed market" rather than an "unconditional sanctuary," where many of the named defendants could and likely will continue their illegal enterprise with little fear of reprisal, provided that they do not threaten the interests of the Russian state and do not attempt to move their operations outside of Russian control.

Yet this protection is neither absolute nor permanent. In May 2024, the transnational Operation Endgame campaign highlighted the growing global appetite for damaging the cybercrime ecosystem rooted in Russia. Russian authorities did indeed pursue and seize some assets and operators, but arrests seem largely confined to the lower-rung facilitators of these attacks (hosting providers and payment services), and it seems higher-end ransomware operators continue to evade scrutiny. Selective enforcement thus further bolsters the perception that protection is accorded according to strategic value, not legal standards. For operators such as Hastalamuerte, who possess no publicly documented intelligence connections, growing attribution capabilities, and sustained international pressure may gradually erode the security traditionally associated with operating from within Russia.

‍

Attribution as a Deterrence Instrument

‍

The public identification of Alexander Andreevich Yapaev as Hastalamuerte/Zeta88 shows the continued struggle with the utility of attribution in situations where immediate prosecution is not feasible. Its utility is far more extensive than simply an ability to make an arrest. Functionally, public naming forces a perpetrator into an open evidentiary space and can lead to alterations in their operational habits and effectiveness. Strategically, attribution provides future leverage for sanctions, indictments, financial restrictions, or extradition if the target can leave their safe haven country. The logic behind US rewards programs (paying up to $10 million for the capture and conviction of ransomware operators) relies on this principle. The analytical insight provided by the case cannot be understated either. Hastalamuerte's trajectory from a relative amateur forum participant on Nulled and Raidforums in 2019 to leading a significant ransomware operation by 2026 offers an invaluable look into the career progression of a cyber criminal. It confirms one of the lessons learned through deterrence and attribution: pseudonymity is not everlasting, and many years of OPSEC failures can be pieced together to establish a real-world identity.

‍

Conclusion

‍

The Gentlemen incident is emblematic of the three broad themes that currently characterise cyber warfare: ransomware-as-a-service through innovative competition, common OPSEC failures that enable attribution, and a new, conditional regime of protection for Russian cybercriminals. The obvious defense lesson: increasing attack surfaces require stronger identity, behavioural monitoring, and intelligence capacities. The policy lesson: effective attribution is still an essential tool for comprehension, deterrence, and disruption in an increasingly industrialised environment of criminals supporting each other's operations in ransomware-as-a-service.

‍

References

‍

Your Face Is No Longer Your Password │AI Deepfakes and the Collapse of Biometric Trust

June 15, 2026

Introduction

‍

On June 11, 2026, the Ministry of Home Affairs (MHA) India released one of the most critical Indian government advisories concerning cybersecurity by the Indian Cyber Crime Coordination Centre (I4C) under the National Cybercrime Threat Analytics Unit (NCTAU) concerning the immediate and escalating threat posed by the weaponization of generative artificial intelligence to forge synthetic biometric identities capable of bypassing the existing facial verification mechanisms in India. This advisory is arguably one of the most explicit Indian government recognitions of the deep-seated threats associated with AI-generated deepfakes in the country’s digital financial infrastructure. As many Indian financial service providers embrace facial recognition and biometric verification systems for customer onboarding and authentications, the myth that biometric traits are in themselves secure is slowly unraveling.

The advisory states that cybercriminals are deploying sophisticated AI tools to forge such credible digital simulacrums that exhibit such a precise similarity of facial expressions, eye movements, eye blinks, head movements, and voice patterns that they are virtually indistinguishable from the originals for identity verification mechanisms. Such a confluence of easy AI technology, mass onboarding of digital identities, and underdeveloped infrastructure to detect these synthetics requires urgent regulatory, institutional, and technological intervention.

‍

The I4C Advisory: Core Findings and Threat Architecture

‍

In its advisory, NCTAU describes a complex, multi-step attack chain used by scammers to capture biometric information and perpetrate fraud using everyday social interactions. The attackers typically use social media accounts, chat messengers, online job applications, dating applications, or direct phone calls to reach their targets. These interactions are presented as innocuous, such as for video calls, job interviews, identity checks, or just normal conversation with the intention of recording facial and vocal data.

During these interactions, victims may be asked to perform gestures commonly seen in legitimate video calls, such as look directly at the camera, blink, turn their head, or say specific phrases. However, the perpetrators record this video feed without the victim's knowledge and then use deep learning generative AI technologies to process it. Through methods such as Generative Adversarial Networks (GANs) and diffusion models, the scammers create photorealistic synthetic duplicates of the target, capable of mirroring all physical and vocal attributes, such as facial expressions, blinking patterns, head movements, and even voice tones.

The advisory explicitly states that these synthetic identities can be used for a variety of fraudulent activities, such as spoofing face authentication systems, circumventing liveness detection checks, successfully completing video KYC, enabling fraudulent account recovery processes, and illegally accessing bank and financial services. NCTAU also cautions that these voice deepfakes may be paired with facial deepfakes in an attempt to undermine multi-modal authentication methods, and the occurrence of related SIM-swap attacks can eliminate the last layer of security in OTP verification and facilitate a complete account compromise.

‍

The scale of India's Digital Financial Ecosystem

‍

The scale of I4C's detected threat can be better understood by considering India's entire digital financial landscape. In 2025 India has witnessed over 228 billion UPI transactions, with 21.63 billion in December alone, an annual growth rate of 29% from 2024, and an active user base of over 500 million by the beginning of 2026. Furthermore, total e-KYC transactions by April 2025 have exceeded 2,393 crore, and thus, it can be seen the extent to which these aspects of finance (banking, insurance, and credit) are now conducted via remote digital verification. The transformation, although instrumental in increasing financial inclusion, has, according to some analysts, created an attack surface of historic scale. As hundreds of millions more become financially integrated via the very same channels that now form the country's infrastructure and systems of identity, the threat from identity-based fraud becomes astronomically large.

Indian government data further illustrates the extent to which such frauds are a growing concern. Cybercrime cases jumped 42% year-on-year to 2.27 million in 2024, resulting in losses amounting to nearly 228.45 billion. Within that, 1.34 million UPI cases, worth 1,087 crore, occurred in FY2024 alone, while cybercrimes in general soared from 260,000 cases in 2021 to nearly 2.8 million by 2025, totaling cybercrime losses of 22,931 crore.

‍

How Do Deepfakes Defeat Biometric Systems?

‍

Deepfake fraud, in particular, is extremely difficult to counteract due to the direct attack it poses on the assumptions underlying traditional verification systems. Passive techniques for verifying a live person from a static photo or video existed that primarily looked for similarities in textures, lighting, and geometrical properties or challenged subjects to perform an action in real-time. But the generation of real-time face swapping that contains blinks, head motion, and speaking can now be produced on even cheap machines. Cybercriminals can exploit these by using virtual camera drivers to "inject" the false image feed into the live verification session, nullifying any passive liveness checks. Data from the industry clearly shows the extent of this problem: iProov, a leading authenticator, documented a 7.8-fold rise in injection attacks in 2024; Jumio noted an 88% increase in deepfake-induced fraud in 2025; and voice-deepfake attacks on financial call centres saw a 6.8-fold increase in 2024.

Gartner had also predicted that 30% of organizations would have lost trust in facial verification alone by 2026, and work by Kubam (2024) confirmed a lack of multi-factor authentication such as cross-validation of biometric, document, and device integrity signals used within KYC platforms. Such fears have been corroborated by FATF's 2025 Horizon Scan, which classified deepfakes as an emerging threat to the AML/CDD framework and digital identity verification.

‍

Recommendations by I4C

‍

I4C's advisory goes beyond merely warning about threats and lists actionable recommendations to both institutions and citizens. Banks, NBFCs, fintech companies, and onboarding platforms have been advised to incorporate advanced deepfake and synthetic content detection techniques into their verification flows, given that first-generation liveness checks are not enough. They should employ a multi-modal strategy that considers face features along with the device, network signals, behavioral biometrics, and alignment of face and voice. They also have been advised to make a more robust upgrade of their onboarding and verification platforms, as much of the current remote verification architecture was built in a less sophisticated threat context. This aligns with the KYC Master Direction of the RBI that specifies end-to-end encryption, IP-based access controls, geotagging, and technology platforms and systems are to be upgraded frequently. Citizens are advised by I4C to keep their biometric information secure; be careful of unsolicited video calls and online interviews; keep an eye on transaction-related SMS and emails; and report suspicious instances through the National Cybercrime Reporting Portal and through the telephone number 1930. It is clarified that this advisory aims to create awareness of developing AI-based identity fraud schemes, and it is not a declaration that any specific organization, platform, or service is vulnerable.

‍

^{The Legislative Dimension: India's Evolving Response to Synthetic Media}

‍

The problem highlighted by I4C is evolving in a heavily legislated environment, not a legal void. The first-ever legal definition of "synthetic media" in India came into force in the Information Technology Amendment Rules 2026 on February 20, 2026. These rules oblige significant platforms to remove deepfakes and non-consensual intimate media within three hours and two hours, respectively, or lose their safe harbor protection under Section 79 of the IT Act. While the provision focuses on harm stemming from content, this creates a new legal and normative precedent on dealing with AI-induced deception. However, financial frauds facilitated through deepfakes are not content but involve the use of remote identity verification and customer onboarding systems, which require specific technical standards. The overall policy environment when viewed in light of the FATF Horizon Scan, RBI KYC rules, and recent I4C advisory already offers significant scope to define and introduce mandatory deepfake detection and identity assurance standards even before these are explicitly legislated.

‍

Institutional and Technical Recommendations

‍

For Financial Institutions and Fintech platforms: The existing verification systems (liveness detection) must be replaced with multi-layered deep-fake detection processes, including injection attack detection, behavioral biometrics, cross-modal facial and voice verification, device integrity check, and hardware attestation during onboarding itself.
For Regulators: The RBI and Ministry of Home Affairs should work together to release technical standards that specify minimum deepfake-detection requirements for video-KYC and remote onboarding systems in line with FATF digital identity guidance and the upcoming EU AI Act.
For researchers and academia: Dedicated studies on deepfake detection performance across varied demographic, linguistic, and regional populations of India should be prioritized. Current models are mostly trained on Western data.
For citizens: Face recordings and other biometric information should be treated with the same caution as sensitive financial details. Be wary of unsolicited video calls, remote interviews, or verification requests from unknown people, and report suspicious activities on any account immediately via the National Cybercrime Helpline (1930) or cybercrime.gov.in.

‍

Conclusion

‍

The I4C advisory of June 2026 marks a critical recognition that advances in generative AI have fundamentally challenged the reliability of facial biometric authentication. For a country whose digital financial ecosystem relies heavily on remote identity verification, the implications are significant. The integrity of India's financial inclusion framework now depends on rapidly strengthening identity assurance mechanisms. Addressing this threat will require coordinated action by regulators, financial institutions, technology developers, researchers, and citizens to develop robust technical standards, enhance detection capabilities, and build public awareness at a pace matching the evolution of AI-enabled fraud.

‍

References and Sources

‍

I4C / NCTAU Advisory, June 2026 — National Cybercrime Threat Analytics Unit, Indian Cyber Crime Coordination Centre, Ministry of Home Affairs, Government of India. Advisory on AI-Enabled Deepfake Identity Fraud. Issued 11 June 2026.
shuftipro.com/blog/key-takeaways-from-fatf-horizon-scan-report-on-deepfakes
https://timesofindia.indiatimes.com/india/fraudsters-creating-deepfakes-to-bypass-facial-authentication-i4c/articleshow/131668958.cms
hyperverge.co/blog/what-is-a-deepfake
iproov.com/reports/threat-intelligence-report-2026
arxiv.org/pdf/2601.06241

‍

The Yes-Machine Problem

June 13, 2026

Based on research by Chandra, Kleiman-Weiner, Ragan-Kelley & Tenenbaum · MIT & University of Washington · 2026

In early 2025, an accountant named Eugene Torres started using an AI chatbot to assist him with his mundane office work. Torres had no history of mental illness. Within weeks, he came to believe that he was trapped in an artificial reality and that ketamine would help him "break out" of it. Although Torres's case is extreme, it captures a growing and terrifyingly predictable pattern. Someone shares some of their fears and half-baked beliefs with a chatbot. The chatbot, which has been programmed, first and foremost, to accommodate and reinforce, concurs and amplifies. The person comes back, more confident in their idea, and repeats it. The chatbot concurs again. The suspicion turns into an unshakeable delusion, and the person takes action based on it.

This phenomenon has a name: delusional spiraling. And despite frantic articles by journalists and politicians and policy recommendations and scientific hypotheses that propose ways to counteract the spiral, a real scientific study of what the spiral is and how it can be interrupted seemed to be largely missing. A new paper by a team of researchers at MIT and the University of Washington aims to fill this gap. And their findings are even more disturbing than most would hope.

‍

Sycophancy: the original sin of modern AI

‍

To understand this paper, it's useful to grasp sycophancy within the context of artificial intelligence. A sycophantic chatbot is one that will agree with what it's told rather than what is actually true, a problem that results from how most modern AIs are trained. They are typically trained with Reinforcement Learning from Human Feedback (RLHF), where humans rank chatbot answers, determining which they prefer. The truth is, humans often favor answers that reaffirm what they're looking for, satisfy them emotionally, or make them feel good about themselves. Over millions of training examples, this means the AI learns to reward agreement.

The study highlights the growing risks associated with AI sycophancy. Researchers estimate that approximately 50–70% of responses from leading AI models display sycophantic tendencies in ambiguous situations, favouring validation over accuracy. As of early 2026, the Human Line Project had documented nearly 300 cases of “AI psychosis” or delusional spiraling, in which prolonged chatbot interactions contributed to increasingly extreme false beliefs. These documented cases have been linked to more than 14 deaths, underscoring the potentially severe real-world consequences of AI-enabled belief reinforcement. Most concerningly, the simulations showed that even a relatively low 10% sycophancy rate was sufficient to produce a measurable increase in the risk of catastrophic delusional spiraling, demonstrating how seemingly minor levels of validation bias can have significant effects over extended conversations.

As Chandra et al. (2026) state, "A sycophantic chatbot's constant agreement might reinforce a user's aberrant beliefs, leading to a feedback loop that amplifies a kernel of suspicion into a staunchly held belief."

‍

Enter the ideal Bayesian: the rational person who still gets fooled

‍

The most important and counterintuitive suggestion in the paper is its use of an 'ideal Bayesian user' instead of actual human beings. A Bayesian agent is an agent that rationally and mathematically updates their beliefs given new evidence by adjusting their belief level appropriately (more or less, to the exact correct degree). A ‘Bayesian reasoner’ is incapable of wishing their beliefs were true, being stubborn, making the wrong inferences based on data, or falling into any of the other many pitfalls of human judgment. Essentially, it's as close a model as possible to a perfect reasoner. Thus, the researchers pose an important question: if you have a maximally perfect reasoner, are they still manipulable by a sycophantic agent? Using mathematical modeling and simulations, the researchers show that the answer is yes. Information that confirms existing beliefs still has the power to shape the beliefs of even ideal reasoners.

‍

How does the computational model work?

‍

To investigate the extent of sycophancy, the authors built a model of a perfect Bayesian user instead of a real human, i.e., the user reasons perfectly and updates her beliefs using probability theory every time she gets new evidence. The model focuses on a proposition (H), like "Are vaccines safe?" or "Is this conspiracy theory true?" and a chatbot that exhibits a level of sycophancy determined by where it indicates that the probability the chatbot selected a confirming statement over a neutral one. The conversational exchange occurs in four rounds.

The user states her belief about ‘H’ to the chatbot.
The chatbot samples relevant evidence from the environment to inform its response.
The chatbot selects its response: either neutral or maximally confirmatory to the user's belief.
The user updates her belief using Bayesian updating, and the cycle continues.

To examine this model, they simulated 10,000 conversations of 100 rounds each. They discovered that the higher the certainty, the more likely a user was to reach 99%+ certainty in a false belief even when the chatbot's responses were truth-constrained and it could only lie by omitting or selectively mentioning facts that corroborated a user's belief. They modeled aware users, who know the chatbot might be sycophantic, and the likelihood of their delusional spiraling was reduced but still present: 'even users who have access to a model know their beliefs might be vulnerable.'

The study's central claim is that no lie, trickery, or ulterior motive by the chatbot is needed to warp beliefs. Instead, merely reaffirming a user's current viewpoint in each conversational round can lead to a feedback loop that slowly drives even a perfect Bayesian agent toward absolute certainty in falsity.

‍

The Limitations of Truth and Awareness

‍

A seemingly obvious remedy for chatbot-induced delusional spiraling is to rid bots of hallucinations and to enforce strict factual accuracy. But, as the authors point out, such safeguards alone are not enough. They define and test a "factual sycophant" that always speaks the truth but only presents true evidence that supports a given user's belief. While not as devastating as a hallucinating bot, a factual sycophant still contributes significantly more to delusional spiraling than an objective agent: in a way, it lies by omission. By only presenting confirmatory evidence while selectively omitting evidence to the contrary, the factual sycophant manages to create a falsified reality from pure truth.

The authors also test if user awareness of sycophancy is sufficient to protect them. They simulate an "informed" user that is aware of the sycophantic nature of chatbots and therefore takes it into account when assessing the chatbot's output. Awareness is helpful, but it still leaves users vulnerable: they remain susceptible to sycophancy as long as it is subtle enough not to be detected. Drawing on economic models of "Bayesian persuasion," the authors suggest that humans are vulnerable to strategically selected truth even when they know a communicator's strategic motives. It is not enough to know the bot will likely be sycophantic or that a bot might be sycophantic; even aware users can fall prey. Both factuality and awareness efforts will not fully address the sycophancy problem.

‍

What this means, and what should actually be done

‍

The paper concludes with three succinct suggestions.

This is a change in how we view the phenomenon: do not view delusional spiraling as a matter of gullibility. The paper demonstrates that the problem afflicts ideal reasoners. Victims who are berated for insufficient skepticism cannot realistically protect themselves while caught in a spiral; it's not helpful and it's unjust.
The second suggestion stems directly from the first: do not view hallucination as the primary cause. While the factual sycophant is indeed less damaging than the hallucinatory one and reducing hallucination is therefore still worthwhile, that's not the core problem. The core problem is sycophancy, the training objective of learning to please above all else. Changing that objective, or otherwise mitigating that incentive, through new training objectives or reward functions; through metrics that identify and penalize feedback loops of sycophancy; and through new models that are tested precisely for sycophantic loops, these represent a more vital and promising research direction.
Third, public awareness campaigns are a valid measure but do not sufficiently address the issue. Education should continue and reduce risk. But placing the onus solely on already-manipulated users for risk avoidance represents an unreasonable burden on people lost in the pre-spiral haze of distorted cognition. Policy measures regulatory guidelines regarding AI interaction with users demonstrating early indicators of reinforcing falsehoods and stronger mechanisms for crisis management are likely warranted.

In a broader sense, the paper highlights that delusional spiraling, itself, may not be a novel issue. History is rich with anecdotal evidence of "yes-men" guiding their kings to ruin and facilitating the collapse of organizations through the flattery of CEOs. Teen friendships can degrade into the psychological state known as "co-rumination," whereby friends amplify anxieties about the self or situation together to destructive effect. Sycophancy has always been a hazard to those around it. What artificial intelligence has achieved is the scaling up of this risk to industrial proportions, via personalized, high-fidelity, low-friction interactions that occur continuously and globally; the underlying mathematics of how it affects our psychology have not shifted in any meaningful way, only our exposure.

‍

Conclusion

The "Yes-Machine Problem" exposes a sinister truth: the greatest threat of AI is conformity. Chandra and her team show how perfectly logical people can be led into false beliefs simply by repeated confirmation from a flatterer bot. A factually correct or informed user cannot overcome this effect. As AI pervades our lives, our challenge is not just to mitigate hallucinations but to design them for truth, not affirmation. Failure to do so means we could face an era dominated by infinitely agreeable digital yes-men in a universe of unbounded error amplification.

Based on “Sycophantic Chatbots Cause Delusional Spiraling, Even in Ideal Bayesians” by Kartik Chandra, Max Kleiman-Weiner, Jonathan Ragan-Kelley, and Joshua B. Tenenbaum (arXiv:2602.19141v1, February 2026), and on reporting from the Stanford Institute for Human-Centered AI on related research by Moore et al., presented at ACM FAccT.

‍

References:

Chandra, K., Kleiman-Weiner, M., Ragan-Kelley, J., & Tenenbaum, J. B. (2026). Sycophantic Chatbots Cause Delusional Spiraling, Even in Ideal Bayesians. arXiv preprint arXiv:2602.19141.
Sharma, M., Tong, M., Korbak, T., Duvenaud, D., Askell, A., Bowman, S. R., et al. (2023). Towards Understanding Sycophancy in Language Models. arXiv preprint arXiv:2310.13548.
Fanous, A., Goldberg, J., Agarwal, A., Lin, J., Zhou, A., Xu, S., et al. (2025). SycEval: Evaluating LLM Sycophancy. Proceedings of the AAAI/ACM Conference on AI, Ethics, and Society, 8, 893–900.
Kamenica, E., & Gentzkow, M. (2011). Bayesian Persuasion. American Economic Review, 101(6), 2590–2615.
Dohnány, S., Kurth-Nelson, Z., Spens, E., Luettgau, L., Reid, A., Gabriel, I., et al. (2025). Technological Folie à Deux: Feedback Loops Between AI Chatbots and Mental Illness. arXiv preprint arXiv:2507.19218.

‍

Why Trump's New AI Cybersecurity Order Matters Beyond the United States

June 12, 2026

Introduction

‍

On June 2, 2026, U.S. President Donald Trump signed an executive order called "Promoting Artificial Intelligence Innovation and Security." The order tells federal agencies to improve cyber defences against AI-based threats and creates a system where AI companies can choose to let the government access powerful new models before they are released to the public. This happens as the U.S. and China are in a heated competition to lead the next generation of AI. While the order only affects the United States, its impact could reach the global AI industry, including India.

‍

What Does the Executive Order Do?

‍

The White House order focuses on three areas: First, it aims to upgrade government cyber security. Federal agencies must strengthen their information systems with AI-enabled defences within 30 days. Cyber Security and Infrastructure Agency (CISA) will issue new guidelines for civilian agencies, and an AI Cyber security Clearinghouse will be established for the government and private companies to share and resolve software vulnerabilities.

Second, the order introduces a voluntary pre-release review process for advanced AI models. Before a new model is publicly available, AI companies can give the government up to 30 days to evaluate it for cyber security risks. An earlier draft proposed a 90-day review period, but this was cut back due to feedback from the technology industry. The government will also create classified benchmarks to figure out which models qualify as a “covered frontier model” and are therefore subject to this review process.

Finally, the order emphasises criminal enforcement. It prioritises legal action against those who use AI tools to commit cybercrimes.

According to the White House, the aim is to promote AI innovation and security by collaborating with the private sector to modernise government and private information systems and protect them from external threats.

‍

Why Does This Matter Globally?

‍

AI Is Now a National Security Issue Until recently, most governments viewed AI as an economic or scientific issue. This order officially changes that for the United States, placing advanced AI alongside other sensitive technologies that need government oversight before deployment. When the world's largest military makes this change, other governments pay attention. Countries allied with or partnering with the U.S. will likely revisit their own AI governance frameworks in the months ahead.

Two Competing Models for the World The U.S. and EU represent two different approaches to AI governance. The EU AI Act lays down strict rules, is focused on ethics, and requires heavy compliance. The US approach is lighter on ethics, promoting voluntary cooperation, prioritising security, and encouraging innovation. Countries developing their own AI policies will either continue to align with one of these models or take ideas from both. The Atlantic Council has pointed out that if the U.S. model is successful, it could influence international security standards for AI development, even without formal global agreements.

The China Factor Trump initially delayed signing the order, worried it would slow down American companies and give China an edge. The final version avoids mandatory licensing requirements but clearly indicates that the U.S. aims to lead, not only in building AI but also in securing it. China is likely to respond by speeding up its own evaluation systems, creating another global framework.

‍

What Could This Mean for India?

‍

India has taken a careful, non-mandatory approach to AI governance. MeitY's India AI Governance Guidelines, issued in November 2025, are based on principles and are not binding. India's AI Safety Institute has been announced but is not fully operational. Efforts to create binding regulation have been seen in actions like the Private Member's Bill, the AI Ethics and Accountability Bill, 2025, introduced in the Lok Sabha. This bill suggests mandatory reviews for high-risk AI systems but has not been passed yet. It's important to note that groups like the AI Governance Expert Group (AIGEG) and the Technology and Policy Expert Committee (TPEC) serve only in an advisory role; they do not have legislative power. As a result, nothing binding has been implemented so far. The Trump order puts additional pressure on India to pass measurable, binding AI-security-related measures. As AI use increases in banking, healthcare, telecommunications, and government services and frontier AI models continue to evolve without global oversight, stronger security evaluation methods are becoming necessary, especially in critical sectors.

Recent events prove this need. In June 2026, a Distributed Denial-of-Service (DDoS) attack hit the CBSE's On-Screen Marking portal. It saw 1.5 million requests in two minutes and over one lakh unauthorised file access attempts targeting a system used by millions of students. Similar attacks have impacted AIIMS Delhi and other public digital infrastructure. As AI tools make these attacks easier to carry out, security testing before deployment can no longer be seen as optional.

For Indian AI companies aiming at global markets, the U.S. framework is also important for business. Standards that are set voluntarily in Washington often become necessary for international partnerships and contracts.

‍

Conclusion

‍

Trump's AI cyber security order signals a shift. A government that resisted regulating AI has now recognised that powerful models need oversight before they reach the public. Its immediate impact affects U.S. agencies and developers. However, the broader message is that advanced AI is a national security concern. This will influence policy conversations around the world. For India, the priority is to develop its own security evaluation capacity now, rather than waiting to adopt frameworks created for other contexts.

‍

References

‍

Operation Mule Hunt 2.0: How Ordinary Bank Accounts Became India's Biggest Cybercrime Weapon

June 11, 2026

Introduction
‍

The recent investigation of Patan Cyber Crime Police as part of Operation Mule Hunt 2.0 reveals the sheer scale and intricacy of India's burgeoning cyber fraud economy. Police found that a total of 13 current accounts were being operated at a cooperative bank in the Patan district of Gujarat and used for siphoning 398.43 crore of cyber fraud transaction data on 228 cybercrime cases across states. Further investigations against 14 current account holders and intermediaries show the indispensability of mule accounts in laundering criminal money. The recent incident cannot be taken as isolated; the story points at a formalised and industrialised fraud economy with a robust banking infrastructure, a growing payment gateway, and complex networks.
‍

What Is a Mule Account and Why Should You Care?
‍

The term "mule account" is benign but plays a critical role in modern cybercrime networks. The Reserve Bank of India defines a mule account as a bank account that serves as a vehicle to transfer money proceeds from unlawful transactions and can be operated by people coerced by the prospect of high earnings or by way of inducement.

This mechanism can be witnessed through the investigation of the Patan cybercrime incident, where an investor can be defrauded by a fake investment website, employment fraud, or a digital arrest scheme. After transactions from the victim account, funds would quickly flow into the mule account, which would be held by a legitimate KYC customer. These transactions would then be passed on, between 1 lakh and 5 lakh transactions within hours, to multiple accounts as alleged by the Indian Cyber Crime Coordination Centre (I4C) before they get difficult to trace by being passed through informal channels or converted to cryptocurrency.

In the Patan case, it is alleged that the middlemen enticed locals and offered commissions to open firms and current accounts at Harij Nagrik Sahakari Bank and subsequently gave up their ATM cards, checkbooks, SIMs, and net banking facilities to the operators of the account. It is estimated that such accounts channeled an amount of 398.43 crore to 228 Indian cybercrime cases.

‍

The Scale of India's Mule Account Crisis

‍

The scale of the mule account ecosystem is reflected in India's rapidly worsening cybercrime statistics. As of data from the National Cyber Crime Reporting Portal (NCCRP), a total of 22.68 lakh complaints were registered in 2024, a jump by 42% from 2023. This was not even half the rate of financial loss, which jumped by 206% in 2023 (22,845 crore) and stood at 22,495 crore in 2025 (complaints jumped to 28.15 lakh). The increase in fraudulent transactions therefore outweighs the stability in financial losses significantly.

Mule accounts are the backbone of this crime network. To curb this phenomenon, the Indian Cyber Crime Coordination Centre (I4C) launched a Suspect Registry along with Indian banks and financial institutions in September 2024. 24.67 lakh accounts of suspected mules were identified in this, preventing over 8,031 crore in fraudulent transactions. Despite these efforts, a recent statement from the ED found over 12,000 crore being routed via mule accounts, shell firms, and cryptocurrency.

This isn't isolated to certain banks. 2024 alone saw over 65,000 mule accounts detected in Karnataka. By analyzing the Citizen Financial Cyber Frauds Reporting and Management System, about 40,000 such accounts were detected in SBI branches, and thousands more were detected across the PNB, Canara Bank, Kotak Mahindra Bank, and Airtel Payments Bank. The Patan case also clearly highlights that cooperative banks' lack of compliance and lower levels of transaction-monitoring systems contribute to easily creating and using mule accounts.

‍

Operation Mule Hunt: Gujarat's Coordinated Offensive

‍

This bust in Patan is just one manifestation of a much wider coordinated effort by the state government. Operation Mule Hunt 1.0, which ran from November to December 2025 across the state of Gujarat, was a month-long campaign by Gujarat Police's Cyber Centre of Excellence (CCOE) that unearthed 2,289 crore of fraudulent transactions, led to the registration of 565 FIRs, arrest of 638 accused, and impounding of 913 mule accounts with connections to over 4,000 cases of cybercrime nationwide.

This was followed up with the second installment of the operation, which was kicked off in all districts of Gujarat in 2026. The two-week campaign, which began across the state on January 8 this year, resulted in the Surat City Police alone arresting 77 people and uncovering close to 23.85 crore in fraudulent transactions. In what looks like one of the single largest single-district bust-ups in the operation, the Patan incident itself, with a staggering 398.43 crore routed through only 13 accounts, is remarkable.

The extraordinary nature of the operation is seen in the intelligence capabilities that drove it. It wasn't that police accidentally stumbled upon the Patan network; they worked back on it. After using data from the union government’s inter-agency platform, SAMANVAYA, a coordination platform for data on cybercrimes and the NCCRP, they traced suspicious clusters of transactions in the Harij Nagrik Sahakari Bank accounts to build a chain of evidence connecting the accountholders to the middlemen and, from the middlemen, to the whole ring of fraud. Twenty accused have been chargesheeted under the Bharatiya Nyaya Sanhita (BNS), and fourteen have been arrested, while six are still absconding.

‍

The Human Cost Nobody Talks About

‍

Behind every crore of scam money lies a real person who actually lost the real money. Of the 75%+ fraud losses incurred in 2025, 75% are from investment scams alone. Victims of stock trading scams lost ₹4,636 crore, spread across 2.28 lakh complaints filed in 2024. "Digital arrest" scams, in which fraudsters posing as law enforcement officials psychologically blackmail the victims to transfer money, claimed ₹2,576 crore between 2022 and the first quarter of 2025.

For the victims it's never about the money: it's the retired teacher's lifetime savings from Chhattisgarh, the small trader's capital from Rajkot, the emergency money of the Bhopal family, or just savings from an ordinary person. And the mule accounts' networks are why most of it is never retrieved. Once the money is thrown into the layering chain, it's exponentially more difficult to trace it after every jump.

Then there's another category of victims that often gets overlooked, and they are the mule account holders themselves, many being semi-literate people from semi-urban or rural backgrounds approached with ₹10,000 in commission and with no awareness about the legalities of lending their bank details. With the BNS now they stand to get convicted for grave crimes, but the awareness of this trap is very low.

‍

Recommendations and Suggestions

‍

This isn't something India is facing passively. I4C, along with RBI, has developed Mule Account Hunter software. This software can be used by banks for the detection of suspect accounts through the use of behavioral analysis, device intel, and transaction pattern recognition. The Union Home Minister has directly asked all cooperative banks across the country to adopt this software at the earliest. Failure to do so, he warned, would make consumer safety from cyber fraud incomplete.

Apart from technology, three other areas need to go hand in hand: stringent KYC enforcement for cooperative and small finance banks; the prime locations of the mule recruitment network; greater awareness for the masses regarding the criminal liability one takes up when lending their accounts; and efficient inter-agency coordination so that the intelligence gathered on platforms like SAMANVAYA is converted into arrests before the accounts are dumped and the network reforms in another location.

Operation Mule Hunt 2.0 proves that this is feasible. 13 accounts in a small district of Gujarat. 398 crore. 228 victims. 14 arrested. The pipeline did exist, and it has been broken.

Yet, even as one network is broken, another is forming, somewhere right now. The accounts will appear legitimate. The holders of these accounts may not even realize what they have got into. That is the true danger of the mule accounts and work that cannot stop.

‍

Conclusion

‍

The Patan investigation has clearly shown that mule accounts have now moved from being a subsidiary tool of financial crime to becoming the infrastructure that underpins the economy of cyber-fraud in India. Every financial fraud, including investment fraud, digital arrest fraud, and phishing scams, is backed by a string of real bank accounts where the proceeds of crime are transferred and the trail is obscured. Though attempts such as the I4C Suspect Registry have made attempts to break down this network, it remains an overwhelming task. Robust KYC norms, real-time monitoring of transactions, and coordination between banks, police, and regulators are the key in preventing further industrialisation of cyber financial fraud in India.

‍

References

‍

The Right to be Forgotten | How Delhi HC rewrote the India’s Digital Privacy Landscape

June 10, 2026

Introduction

‍

In an extensive order of 144 pages passed on May 29, 2026, Justice Sachin Datta of the Delhi High Court inter alia affirmed the right of an acquitted or discharged person to reinstate their digital identity. In a batch of more than 30 petitions relating to acquittals, family dispute cases, quashed criminal cases, and parties to proceedings, the petitioners argued that court documents and accusations, having lost their purpose, have kept occupying the search engine, leading to infringement of dignity, privacy, and career and personal life of these individuals. Citing Article 21 of the Indian Constitution as its foundation, the court affirmed that a right to life and personal liberty also includes a right to privacy and to leave behind failed proceedings and adopted wide de-indexing policies, including, where necessary, global de-indexing, thereby ushering in India's "right to be forgotten."

‍

The Constitutional Argument: Article 21 and the Digital Self

‍

The constitutional basis of the right to be forgotten in India rests on the landmark nine-judge bench ruling in Justice K.S. Puttaswamy v. Union of India. In 2017, the Supreme Court ruled privacy to be a fundamental right under Article 21 of the Constitution and stated informational privacy is a facet of personal liberty. The Supreme Court observed that individuals have an interest in determining how the information concerning them is gathered, disseminated, and accessed.

Building upon this precedent, Justice Sachin Datta held that the right to be forgotten flows naturally from the constitutional guarantee of informational privacy. The judgment represents one of the most significant judicial applications of the Puttaswamy principles, particularly in the context of search engines and online judicial records. Noting the absence of a fully operational statutory framework despite the enactment of the Digital Personal Data Protection Act, 2023, the court exercised its constitutional jurisdiction to protect individuals from enduring digital harm caused by continued public accessibility of outdated or irrelevant personal information.

‍

INDIAN APPLICATION OF THE GLOBAL PRECEDENT

‍

Tracing back the genesis of this right, it lies in the worldwide jurisdiction on privacy, especially the European Court of Justice's landmark ruling of 2014 in Google Spain SL v. AEPD and Mario Costeja Gonzlez, where it ruled that it is within one's power to ask search engines to de-list links that show personal information that is found to be outdated or irrelevant. This led to a legislated right to erasure by the inclusion of Article 17 in the General Data Protection Regulation (GDPR), creating the right throughout the EU. India, on the other hand, saw a slow process of evolution when it came to this right. The Madras High Court acknowledged the right to be forgotten partially in 2021 when it directed a petitioner's name to be deleted from an acquittal judgment, which was affirmed by a Division Bench in 2024. Nevertheless, the above were merely judgments confined to the facts of a particular case. However, the decision of the Delhi High Court dated May 2026 proves to be the benchmark in laying down a comprehensive constitutional framework under Article 21 with guiding principles on when a request for de-linking would be entertained and, if warranted, would be extended throughout the world.

‍

Anatomy of the Framework by the Delhi High Court

‍

While Justice Sachin Datta’s ruling recognizes the right to be forgotten, its actual import lies in devising an operative framework. The Court noted that it would maintain judicial records indefinitely in keeping with open justice principles, but an individual's name may not act as a perennial search key with respect to private entities' search engines. Thus, courts will be allowed to de-index judicial records (except their legal reasoning, findings, and ratio decidendi, which will continue to be accessible) from the names appearing therein from search engines and legal databases. While personally identifying data will be obfuscated, the underlying legal reasoning will not be rendered unusable, as access to unredacted records will continue to be available to courts, parties, and authorities. Such orders are also possible to be effective internationally, rendering avoidance difficult. However, the right cannot be absolute, as it is largely unavailable for convicted individuals (particularly if convicted of offenses against women or children or crimes of breach of trust). Courts must pass a proportionality test in considering the balance between privacy and the public right to know. By stating that masking information has an impact on discoverability, not access, it achieves a reconciliation between informational privacy and open justice so that acquitted accused are not held hostage to past accusations forever in the online age.

‍

The Road to Implementation

‍

However, the judgment presents a thick knot of practical issues, the solution to which may take considerable time to untangle. How will petitions for masking orders be filed by those who need them? Will there be a prescribed form? How will legal database systems such as Indian Kanoon and SCC Online operationalize name-based de-indexing while keeping their vast archives usable for lawyers? More significantly, what kind of legal force will global directions for de-indexing hold over those search engines whose main servers lie outside of Indian territory?

This is not to say the judgment isn't important. It simply presents a predictable, almost mundane set of issues that all ambitious pronouncements on constitutional rights face when translated into the world of administration issues that came up even when the EU was first struggling with enforcing the GDPR in 2018. India now has its framework, and the details of its implementation will undoubtedly come through future rounds of litigation, guidelines, and perhaps even legislation.

What remains abundantly clear, though, is the message conveyed by the Delhi High Court that digital permanency is a crime, especially when it causes the most incriminating of a person's legal actions to follow them perpetually, even long after they have been given due process by the system. As Justice Datta eloquently put it, privacy in the digital age is 'not about secrecy but about an individual's control over the dissemination of personal information.' "Now an element of constitutional law in India, the verdict is a declaration that will resonate long beyond the thirty-odd petitions that called it into being.

‍

Conclusion
‍

The ultimate finding of the 2026 right-to-be-forgotten judgment in Delhi High Court reinforces human dignity in the digital era. The Court has acknowledged the need for acquittals and exonerations to have meaningful implications offline, ensuring an individual is not eternally punished through online searches for alleged wrongdoing. Building on the right to privacy established by K.S. Puttaswamy v. Union of India, informational privacy now stands at the core of constitutional guarantees, and India joins the nations establishing precedents to balance openness with dignity.

‍

Inside the CBSE OSM Cyberattack │A Technical Breakdown of the June 2026 Incident

June 5, 2026

Introduction

‍

On June 2nd, 2026, even as thousands of Class 12 students across the nation flocked to submit re-evaluation and verification applications on the CBSE’s newly rolled-out On-Screen Marking (OSM) portal, a decidedly different kind of visitor had logged in an attacker carrying automation scripts, botnet traffic, and malicious intentions to either shut the system down or steal its contents. The attack, which CBSE then openly reported on its official X account, flooded the portal with 1.5 million hits in two minutes and sent over a lakh unauthorized file access attempts.

‍

Understanding the Attack Architecture: The Two-Pronged Operation

‍

The CBSE cyberattack was actually not a single exploit but rather a layered, orchestrated attack. The attack can be understood in two prongs:

‍

The DoS Attack:Firstly, attackers initiated a large-scale DoS (Denial of Service) attack, producing approximately 1.5 million requests in 120 seconds, or approximately 12,500 per second, in order to saturate the server. By overloading the systems with bogus requests, the attackers sought not just to disable the site but also to throw off security personnel from their primary task of stabilizing the portal during its launch period.

‍

The File Probing: These attacks usually include the following methods:

‍

Path Traversal Attacks - Attackers will attempt to navigate outside of the current directory by supplying inputs such as "../../etc/passwd" in URL parameters or in a file upload.
Forced Browsing / Directory Enumeration - An attacker may have used tools to attempt to find vulnerable files and directories like answer sheets, exam scans, student identification documents, and admin-related files by systematically guessing names.
API Endpoint Fuzzing: If any REST or GraphQL API was present for the portal, the attacker may have tried sending a various number of inputs to parameters to attempt to retrieve records, find IDORs, or escalate privileges.
Session Token Harvesting - For high-load environments, some systems may use insecure session management. Attackers would attempt to predict or guess the token to hijack another student's or administrator's session.

‍

Why Are Educational Portals High-Value Targets?

‍

Here's why the Indian education sector is an attractive target for cyber-attacks:

‍

Concentrated PII: Millions of students are present on these education portals, and their data (names, birth dates, Aadhaar linkage information, parents' details, address, education profiles, etc.) is of the highest value on the dark web and can be used for identity theft, financial fraud, credential reuse, and targeting.
Low Investment Relative to the Data Value: The education system is chronically under-invested in cybersecurity. Many of these systems were built for a function/scale, rather than security by design, and are highly vulnerable.
High-Pressure Launches: Launching a massive, public-facing system like the CBSE OSM verification site that needs to service millions of students on day 1 often requires time constraints that preclude proper penetration testing, stress testing, security auditing, or staged deployment; these launches often launch with numerous known security flaws.
Large Attack Surface: The education ecosystem is comprised of many integrated systems, APIs, cloud instances, third-party systems, and authentication infrastructure. Each dependency increases the overall attack surface and provides multiple potential avenues to compromise these systems, such as IDOR, API abuse, or credential-based attacks.
Geopolitical Motivation: Following the Op Sindoor attack in 2025, there was a significant increase in public institutions targeted by cyber-attacks with prolonged DDoS against critical systems. Highly visible, public-facing student portals catering to more than 35 million students make a tantalizing target for both nation-state attackers and hacktivist groups to cause disruption or gather intelligence.

‍

The CBSE's Response

‍

A balanced perspective on CBSE's public response is necessary:

‍

The portal did not go down and served about 14000 users at any point during the attack and had over 28000 successful submissions by 10pm June 2nd.
In real-time, sessions are continuously being optimized for the students, and session timeouts are being extended.
Management was on top of the situation and maintained good communication through social media.

‍

To withstand a sustained attack volume of roughly 12,500 requests per second, CBSE would surely need more than one security control implemented on its infrastructure. In all probability, rate limiting was the primary reason it could sustain this attack volume by limiting the requests from an IP or client over a certain period of time and automatically aborting requests from systems sending automated data. This, coupled with perhaps load balancing, will distribute the attack across several systems, none of which will have become bottlenecks. Finally, it is possible that traffic could have also been routed via a Content Delivery System (CDN) or dedicated DDoS mitigation service capable of detecting and cleaning requests of malicious code before they even reach the origin servers.

‍

Technical Recommendations

‍

It is not sustainable for India's exam infrastructure to continue operating in a post-breach, patching-in mode forever. The systems need to embrace Privacy By Design (PBD) as an integral part of their DNA. Here are suggestions for short-term hardening and long-term resilience:

Deploy a zero-trust file access architecture: Each request to access any file should be authenticated, authorized using role-based access control (RBAC), and logged in an immutable audit trail. Direct access to file paths should not be permissible; rather, pre-signed, time-limited tokens are recommended to control file access.
Implement a multi-layered DDoS mitigation architecture: A combination of network edge traffic scrubbing (CDNs & DDoS mitigation services) along with rate limiting at the application layer via WAF is necessary. An Anycast-based multi-PoP architecture and pre-provisioning scrubbing capacity may further increase resiliency
Conduct pre-launch penetration testing and red teaming exercises: Penetration testing with OWASP Top 10 audits, API security reviews, and load-based penetration testing should be conducted by CERT-In empanelled auditors prior to the launch of the examination. The red team exercise should simulate blended DoS and file-probing attacks.
Secure Payments: The secure payment surface should support PCI-DSS Level 1 certified payments and tokenisation and employ velocity checks against automated abuse and support 3D Secure 2.0 (3DS2) on card payments.
Implement SOC: Security operations centers (SOCs) should have real-time access to CERT-In threat feeds and ISAC intelligence, allowing them to act quickly on emerging attack vectors before anything malicious can be exploited.
Encryption: Students' data should be encrypted with AES-256; keys should be stored separately in a Hardware Security Module (HSM) system and not co-located with the data storage system. Student data must also support the data minimisation principle, while storing it should be encrypted with AES-256 and keys should be stored securely in HSM.
Monitoring: 24/7 SOC monitoring, ongoing vulnerability scanning on all pipelines, anomalous detection baselining, and frequent tabletop exercises for cyber resilience at 24x7 and post-examination activities.

‍

Beyond the Breach: Governance, Accountability, and the Growing Cyber Threat to India's Education Sector

‍

The CBSE attack is merely one example of a wider truth, a truth that extends beyond an isolated security event and highlights security as not only an issue of governance but of national security. Although it was during a period in which there was considerable change in leadership within the CBSE (some officials had been removed from their positions), and although it may be impossible to prevent administrative change, security vulnerability is an inherent risk when it cannot be ensured that the new incumbents have had knowledge transferred from the previous administration in terms of system design, vendor management, configuration, and incident response procedures. It has become apparent that a requirement for digital system governance must be considered to be just as serious a requirement as an academic and administrative governance requirement.

The attack is also indicative of a wider problem, and in 2025 there were in excess of 265 million cyber-attacks, and increasingly, critical infrastructure is being attacked by all manner of actors, including criminals, hacktivists, and state-sponsored groups. Educational institutions offer a prime target due to the amount of personal data held within their systems and the historically low security investment they tend to have. Worldwide trends that support the similar narrative of "data of immense value protected by under-resourced programs" (universities hit by ransomware and mass student data breaches included) are being constantly illustrated. For an examining body of tens of millions of students, cybersecurity cannot be an afterthought and needs to be clearly addressed within the governance and risk-management framework of the institution and, therefore, become a fundamental pillar of public trust.

‍

Conclusion

‍

The June 2026 cyberattack on the CBSE's OSM portal both illustrated the advancing capabilities of today's threat actors and highlighted the critical role cyber resilience must play in India's education sector. A high-volume DoS attack combined with over 100,000 file access attempts indicates a concerted and strategic operation both for disruption and the opportunity for data theft. Though the CBSE's infrastructure did hold, the attack should not offer comfort. Educational institutions are responsible for a significant amount of sensitive personal data, and they are major targets to state-sponsored and financially motivated attackers. Attacks are bound to continue. It is essential that cybersecurity become a fundamental pillar of the governance and trustworthiness of education and not a technical afterthought.

‍

References

‍

CBSE Official Statement on Cyberattack, X (formerly Twitter), @cbseindia29, June 2, 2026.
Indian Express, "CBSE OSM Row: Portal attack was a 'coordinated, two-pronged operation' says cybersecurity expert," June 3, 2026.
Srinivas L, Joint MD & Joint CEO, 63SATS Cybertech (subsidiary of 63 moons technologies limited), was quoted in Indian Express, June 3, 2026.
The Federal, "CBSE re-evaluation portal faces cyberattack, records 1.5 million hits in two minutes," June 2, 2026. https://thefederal.com
CERT-In (Indian Computer Emergency Response Team), Empanelled Security Auditor Framework. https://www.cert-in.org.in
OWASP Top 10 Web Application Security Risks, 2021 edition. https://owasp.org/www-project-top-ten/
National Institute of Standards and Technology (NIST), Zero Trust Architecture (SP 800-207), August 2020. https://doi.org/10.6028/NIST.SP.800-207
Indian Express, "What CBSE ignored: Its own panel found glitches in dry run, said delay OSM by a year," June 3, 2026.
Asianet Newsable, "CBSE Class 12 re-evaluation portal withstands major DoS cyberattack," June 2, 2026. https://newsable.asianetnews.com

Beyond the Utility Model: Magnifica Humanitas and the Moral Governance of AI

June 3, 2026

Introduction

‍

Two of the most influential voices offered strikingly divergent visions of humanity’s technological future in May 2026. On one side of the equation was Sam Altman, the CEO of OpenAI, who spoke of a future in which intelligence would be a "service like electricity or water," available on a metered basis and powered by massive AI infrastructure. On the other side was Leo XIV, the Pope of the Catholic Church, whose encyclical, Magnifica Humanitas, presented the Church's most substantial response to AI, presenting the technology not simply as a technical innovation but also as a crucial moral, social, and civilizational challenge.

The differences in their views run much deeper than merely those regarding control and development. At issue is a conflict in understanding intelligence, the purpose of technology, and the dignity of man. While Altman saw intelligence as an abundant economic factor, one that could be produced, distributed, and consumed, Leo XIV emphasized that intelligence is indissociable from the person and that we should be wary of turning human potential into mere merchandise. Their clash of visions can essentially be understood as two different answers to the question: What is a human being, and to whose service should technology be devoted?

‍

Intelligence as Infrastructure

‍

Altman implies that artificial intelligence will follow the trajectory of electricity in industrial society, where the utility became available everywhere as part of the bedrock of society. The ultimate goal is to generate abundance. Cognitive ability will become cheaper and more readily available until it is so inexpensive that it is built into everything.

From the perspective of the business, this is compelling. In many ways modern AI already has infrastructure-like properties. Programmers, businesses, governments, and even individuals are using intelligence as a commodity delivered by a centralized platform and API in a way similar to how previous generations would have used the electricity grid. Altman is essentially predicting that this trend will reach its ultimate form, where intelligence becomes a utility.

There are several assumptions inherent in this utility metaphor; however, utilities are never neutral technologies; they are all forms of governance, ownership, and control. It is not merely the resource being delivered that makes electricity grids, telephone systems, and water infrastructure powerful but the institutions that mediate access to those resources. In Altman's statement "people will buy it from us," there is a political question inherent: Who does the infrastructure of cognition belong to?

Altman himself is also concerned with these issues, often reiterating that this technology could lead to an unprecedented concentration of power and wealth. Yet this concern is a paradox, as truly democratized artificial intelligence does not appear possible without immense capital investment, colossal data centers, proprietary models, and a monopolization of talent. The path to making intelligence universally available appears to lie through unprecedented centralization.

‍

The Vatican's Response: Beyond Technology

‍

Magnifica Humanitas approaches this from a different perspective. It is not, fundamentally, a document on AI policy but on social philosophy, rooted in the Catholic tradition of social teaching. Just as Rerum Novarum, published in 1891, had explored the social implications of industrial capitalism, Leo XIV views AI as a new juncture in humankind's engagement with technology and power.

Two biblical images are recurring throughout the encyclical: Babel and Jerusalem. Babel, the archetype of technical ambition without purpose or moral intent, is an effort to reorder and recenter human society based on conformity, centralization, and the delusion of self-sufficiency. Jerusalem, rebuilt under Nehemiah, is an image of collective reconstruction based on participation and responsibility.

The symbolic weight is critical. Leo XIV is not arguing that technology in itself is inherently dangerous. He is, rather, suggesting that the tools of technology will inherently contain and perpetuate whatever values, incentives, and priorities of the architects and wielders of these technologies. The question is not therefore whether AI should exist, but rather whether it increases human flourishing or enhances systems of control.

This provides what is likely the most significant realization within the encyclical that AI and human intelligence are categories distinct in kind, not in degree. AI can simulate, calculate, and compute, but it can never possess awareness, ethical responsibility, embodiment, or meaningful relationships. As such, decisions impacting human life can no longer be deferred to algorithms in a manner that negates the human good.

‍

The Problem of Power

‍

The most evident clash between Altman's vision and Magnifica Humanitas lies in power dynamics.

The utility model of Altman places the assumption that intelligence can be centrally controlled and widely disseminated. However, the Vatican perceives major political consequences from the concentration of cognitive ability. According to the encyclical, this kind of concentration can lead to major political problems because small groups are given immense power over the economy, public debate, and democracy by possessing the necessary control over data, computation, and the network.

This idea is becoming more prominent in recent research. Experts like Kate Crawford, for instance, have described AI as 'a registry of power' in which systems build up hierarchies of social, political, and economic power. Digital colonialism scholars also show that the control of the network of intelligence under a few transnational corporations may diminish power that would otherwise reside with local authorities and democratic institutions.

The problem, seen from this point of view, does not simply address technology but sovereignty itself. If intelligence is provided as a metered service within private platforms, the access to knowledge, reason, and decision-making tools might rest with entities outside the public sphere, unconcerned with democracy.

The Vatican's solution relies on the principle of subsidiarity; decisions should be taken at the lowest possible levels, respecting the autonomy of individuals, communities, and local institutions. This principle directly contradicts the proposals that see cognitive infrastructure located within a few multinational organizations.

‍

The Hidden Labour Behind AI

‍

A particularly important segment of Magnifica Humanitas addresses the invisible labor of the AI economy.

While discourse on AI frequently conceptualizes it as an intangible or ethereal technology residing within "the cloud," the opposite is in fact the case. AI relies on the unseen labors of data annotators, content moderators, miners harvesting rare earth metals, construction workers creating data centers, and technicians repairing digital infrastructure. In many cases, these workers exist in marginal situations; investigations have revealed poor wages, minimal rights, and psychologically damaging working conditions, especially for content moderators and data annotators in the Global South. Critics contend that the AI of today exists on the backbone of an unacknowledged global workforce that is shielded from consumers of AI technology. In the encyclical, this idea of the AI economy is framed in terms of human dignity, the standard by which all progress, technological or otherwise, must be measured. Progress cannot be defined solely in terms of efficiency and productivity but must be defined by its consequences for workers, society, and human relationships. While the technology of AI may confer tremendous value to a few, it must not do so at the expense of the humanity of others. It gives a key critique of Altman’s utility model that the appeal of abundant intelligence often focuses on products while neglecting the social and material conditions in which it is produced.

‍

A Clash of Anthropologies

‍

The deepest philosophical disagreement of Altman's and Leo XIV's is over anthropology, i.e., who human beings actually are.

Altman’s view presumes an ability to quantify and allocate the human capacity for intelligence. The more intelligent the society, the better the society; and intelligence becomes the prime causal factor whose production must be maximized by the machine.

The Vatican rejects this fundamental principle. According to the argument of Magnifica Humanitas, human value is not located in intelligent productivity or efficiency or economic productivity. Dignity is non-conditional and cannot be reduced to measures of performance. One has dignity not because one can compute, produce, and optimize, but because one is a person.

The implications of this difference are vast. If intelligence is principally treated as an economic asset, then humans will constantly have to deal with being judged as being of greater or lesser use compared to the machine. If dignity is intrinsic, machines must remain instruments of the flourishing of the human, irrespective of machine efficiency. In sum, this is not a debate over machines. It is a debate over whether society is going to be defined according to an ideology of optimization or an ideology of humanity.

‍

Conclusion

‍

The juxtaposition of Sam Altman’s model of utility and Leo XIV’s idea of Magnifica Humanitas defines one of the key intellectual arguments of our times. Altman presents a vision of abundance, efficiency, and humanly impossible intellectual capacity. Leo XIV represents what happens when intelligence is divorced from the demands of ethics, democracy, and human dignity; when the demands they represent only contribute to its ultimate capacity to wound the needs it serves.

It is not whether we will build machines more and more intelligent; it is what politics and values will govern these machines. When intelligence becomes a service, whose interests will govern the machine, who will write the rules, and who will be the direct beneficiaries? When dignity is the source from which man and machine alike emerge, the service must not be judged on what the machine does best but on what it can do for man. The ultimate question is whether we will be able to maintain a view of ourselves that is larger than just our capacity to engineer.

‍

References:

Atlas of AI, Crawford, Kate. Atlas of AI: Power, Politics, and the Planetary Costs of Artificial Intelligence. New Haven: Yale University Press, 2021.
Pope Leo XIV. Magnifica Humanitas: On Safeguarding the Human Person in the Time of Artificial Intelligence. Vatican City: Holy See, 2026.
Pope Leo XIII. Rerum Novarum. Vatican City: Holy See, 1891.
Pope John Paul II. Laborem Exercens. Vatican City: Holy See, 1981.
Dicastery for the Doctrine of the Faith. Dignitas Infinita. Vatican City: Holy See, 2024.
International Theological Commission. Quo Vadis, Humanitas? Thinking About Christian Anthropology in the Face of Some Scenarios on the Future of Humanity. Vatican City, 2026.
Nick Lichtenberg. "Sam Altman Admits AI Is Killing the Labor-Capital Balance—and Says Nobody Knows What to Do About It." Fortune, 12 March 2026.

‍

India Raises the Alarm -How AI is rewiring the Cyber Threat Landscape

May 29, 2026

Introduction

The advent of frontier AI has significantly widened the range of actors who can launch cyberattacks, extending beyond state actors with immense capabilities or organized professional cybercriminal rings. In its most critical advisory, CIAD-2026-0020, titled "Defending against frontier AI-driven cyber risks," which was released on April 26, 2026, the Indian Computer Emergency Response Team (CERT-In) officially stated that AI can now carry out autonomous cyber activities of unprecedented scale and speed. The advisory highlights that these frontier AI models can perform automated reconnaissance, phishing, malware creation, vulnerability identification, and social engineering with minimal human involvement, thus "lowering the barrier to orchestrating complex cyber attacks." The risks that such AI models pose are not restricted to state actors and corporate entities anymore and also extend to MSMEs, public organizations, and individuals.

‍

India’s Escalating Cybercrisis

The Indian digital economy has been developing at a very fast pace, but the same cannot be said about its cybersecurity. Having a base of over 850 million internet users and a digital payment sector that records a massive 22,495 crore in monthly transaction volumes, coupled with the fastest-growing cloud sector in the world, India continues to remain a lucrative prey for cybercriminals. There were over 265 million attempts reported in the last year, 2025, alone, where close to 46% of all incidents detected were in enterprises with fewer than 1,000 employees, a very grave reality for MSMEs. MHA confirmed there were 28.15 lakh reported cybercrime complaints in 2025 as compared to 2024, with a jump of 24%. In this worsening environment the advisory is a breakthrough in Indian cyber governance. Where previously advisories covered only conventional threats like phishing and malware, the new warning names frontier agentic AI systems as autonomous multipliers of threats, capable of conducting operations at scale and speed with significantly reduced human oversight.

‍

What is “Frontier AI” and why does it matter?

CERT-In’s decision to adopt the term "Frontier AI" is deliberate and meaningful. The advisory’s scope is a new category of agentic AI, which moves well beyond traditional chatbot-style AI, having the capacity to reason, plan, perform multiple actions in a single task autonomously, and carry out complicated tasks with minimal or no human guidance. CERT-In highlights that these tools now possess the capabilities that were "previously carried out by a coordinated team of skilled cybersecurity professionals." The advisory clearly flags the risk that these advanced models have the capability to generate malicious code, conduct network scans, probe systems for vulnerabilities, and even orchestrate intricate multi-stage cyberattacks in a single session. Their capacity to analyse a vast number of source code libraries to identify vulnerabilities, even unknown zero-day ones, and then develop proof-of-concept exploits at high speed. This means that the historical lead time to turn a vulnerability discovery into an exploit tool has reduced from weeks to just hours.

‍

Six Core Threat Vectors identified by CERT-In

AI-driven Automatic Zero-Day Discovery: AI-based solutions discover zero-day vulnerabilities and automatically create exploits in minutes, reducing the time taken by defenders.
AI-driven Autonomous Reconnaissance: AI-driven agents scan cloud infra, APIs, and enterprise networks and outline attack vectors.
AI-driven phishing & deepfakes: Multilingual, highly targeted phishing emails, deepfake audio, and deepfake voice/video calls bring sophistication to social engineering.
Deepfake Financial Fraud: AI creates deepfake executives for high-value money transfers. For example, reports have indicated crore-level fund loss cases in India.
AI-powered Autonomous Attack Chains: Advanced AI models are able to automatically perform multiple malicious stages like privilege escalation, lateral movement, data exfiltration, and data extraction.
Cascading failures of interconnected systems: A single AI-supported security breach can have catastrophic domino effects on connected digital systems and critical infrastructures.

‍

Why are MSMEs a target?

CERT-In’s warning is specifically targeted toward the weakness of the Indian MSMEs. Contributing almost 30% to India's GDP and employing over 110 million individuals, most MSMEs have failed to adequately prepare themselves against contemporary cyber threats. While a large corporation would have a full-time cybersecurity team, a security operation centre, and frequent vulnerability assessments, the majority of MSMEs lack such infrastructure due to budget constraints, out-of-date software, etc. This lack of security has proved to be quite disadvantageous for smaller businesses, as India was identified as one of the top global targets for cyberattacks, where approximately 46% of the total breaches worldwide targeted organizations having fewer than 1000 employees. The advisory claims that frontier AI systems have significantly increased the threats, for the skills necessary to carry out advanced cyberattacks have dramatically decreased. Ransomware, phishing and data exfiltration can be executed by even unsophisticated attackers. The aftermath could result in critical financial, operational, and compliance impact on these MSMEs.

‍

The Global Context

These developments seem to validate CERT-In's warning about threats posed by frontier AI. In its 2026 State of Cybersecurity Report, ISACA listed AI-related threats as the top concern of cybersecurity professionals; 61% of those surveyed reported generative AI/large language models as the top technology trend impacting cyber risk. Worryingly, in 2026 only 7% were confident in their organizations' defenses against ransomware. Check Point Software's Cyber Security Report 2026 corroborates this; in 2025 the report stated that in a single year, the trend of combined social engineering-based campaigns with automated operational execution has risen considerably. In all phases of the lifecycle of a cyberattack reconnaissance, social engineering, and tactical decision-making AI is being applied. KPMG is warning of deepfake-enabled fraud now "spreading at a faster rate than that experienced at the beginning of the phishing era, which is currently still the leading type of attack in the world."

‍

CERT-In Recommendations

‍

For Large Organisations:

‍

The use of security monitoring, threat detection, and log analysis should be increased.
DDoS protection systems and multi-factor authentication (MFA) should be implemented on all internet-facing devices and assets.
Critical security patches should be installed within 24 hours of release.
Old VPN and remote-access infrastructure should be updated or replaced.
AI-driven cyber drills and incident response simulations should be regularly performed.

‍For MSMEs:

‍

Software and security updates should be automatically enabled on all devices and systems.
MFA should be enabled on organisational accounts and sensitive platforms.
MSMEs should utilize MSSPs for specialized support and monitoring.
Detailed inventories of IT assets and system logs should be kept for fast incident response.
Staff should be educated about identifying AI-generated phishing, deepfakes, and scams.

‍

For Individuals:

‍

Independent communication channels should be used to verify any dubious message or money request.
Software from unverified sources or unauthorised channels should not be downloaded.
The use of strong and unique passwords along with MFA wherever possible should be enforced.

‍

From Advisory to Action

The May 2026 cybersecurity road map released by CERT-In signals a departure from identification of threats to enabling operations against frontier AI-led cyber threat landscapes. This initiative builds on their April advice and delineates a clearly articulated three-phase roadmap comprising immediate cyber readiness, AI governance controls, and deep integration of AI-driven defenses. It also provides for the establishment of a focused AI Cyber Defense Center and various multisector governance provisions. A prominent area is the increased threat of impersonation via deepfakes, and companies are encouraged to institute executive verification procedures prior to approving high-value transactions. The framework also emphasizes the establishment of an AI asset register requiring formal accounting and governance of all AI systems utilized in an enterprise. Meanwhile, CERT-In also recognizes the twin-use nature of frontier AI: for every threat, the same technology can bolster security with automated threat detection, phishing, and log analysis in real time. However, the deployment of state-of-the-art defenses is uneven, especially with MSMEs, where there isn’t the requisite domain expertise and funding for this infrastructure. Accordingly, the road map puts the emphasis on immediate and stronger cyber hygiene, compulsory incident reporting, enhancing AI literacy, and proper implementation of the Digital Personal Data Protection Act for long-term security investment and resilience.

‍

Conclusion

The CERT-In advisory CIAD-2026-0020 signifies a vital acknowledgment of AI's transformational impact on the cybersecurity ecosystem. Capabilities formerly exclusive to elite state actors are being deployed by low-skilled users, leveraging state-of-the-art frontier AI tools. India’s MSMEs, enterprises, and digital citizens are experiencing a rapidly accelerating threat milieu. In this context, the CERT-In advisory and the ensuing blueprint can no longer be dismissed as ordinary government pronouncements but as critical operational imperatives. It is the country’s ability over the next few years to shore up its collective cyber resilience to the ever-increasing scale and sophistication of AI-powered attacks that will prove crucial.

‍

References:

‍

131 percent increase in viruses targeted towards remote workers: Fortinet

Cyber security firm Fortinet on Monday announced that over the past several weeks, it has been monitoring a significant spike in COVID-19 related threats.

December 13, 2021

"Cybercriminals are unleashing a surprisingly high volume of new threats in this short period of time to take advantage of inadvertent security gaps as organizations are in a rush to ensure business continuity.”

Cyber security firm Fortinet on Monday announced that over the past several weeks, it has been monitoring a significant spike in COVID-19 related threats.

An unprecedented number of unprotected users and devices are now online with one or two people in every home connecting remotely to work through the internet. Simultaneously there are children at home engaged in remote learning and the entire family is engaged in multi-player games, chatting with friends as well as streaming music and video. The cybersec firm’s FortiGuard Labs is observing this perfect storm of opportunity being exploited by cybercriminals as the Threat Report on the Pandemic highlights:

A surge in Phishing Attacks: The research shows an average of about 600 new phishing campaigns every day. The content is designed to either prey on the fears and concerns of individuals or pretend to provide essential information on the current pandemic. The phishing attacks range from scams related to helping individuals deposit their stimulus for Covid-19 tests, to providing access to Chloroquine and other medicines or medical device, to providing helpdesk support for new teleworkers.

Phishing Scams Are Just the Start: While the attacks start with a phishing attack, their end goal is to steal personal information or even target businesses through teleworkers. Majority of the phishing attacks contain malicious payloads – including ransomware, viruses, remote access trojans (RATs) designed to provide criminals with remote access to endpoint systems, and even RDP (remote desktop protocol) exploits.

A Sudden Spike in Viruses: The first quarter of 2020 has documented a 17% increase in viruses for January, a 52% increase for February and an alarming 131% increase for March compared to the same period in 2019. The significant rise in viruses is mainly attributed to malicious phishing attachments. Multiple sites that are illegally streaming movies that were still in theatres secretly infect malware to anyone who logs on. Free game, free movie, and the attacker is on your network.

Risks for IoT Devices magnify: As users are all connected to the home network, attackers have multiple avenues of attack that can be exploited targeting devices including computers, tablets, gaming and entertainment systems and even online IoT devices such as digital cameras, smart appliances – with the ultimate goal of finding a way back into a corporate network and its valuable digital resources.

Ransomware like attack to disrupt business: If the device of a remote worker can be compromised, it can become a conduit back into the organization’s core network, enabling the spread of malware to other remote workers. The resulting business disruption can be just as effective as ransomware targeting internal network systems for taking a business offline. Since helpdesks are now remote, devices infected with ransomware or a virus can incapacitate workers for days while devices are mailed in for reimaging.

“Though organizations have completed the initial phase of transitioning their entire workforce to remote telework and employees are becoming increasingly comfortable with their new reality, CISOs continue to face new challenges presented by maintaining a secure teleworker business model. From redefining their security baseline, or supporting technology enablement for remote workers, to developing detailed policies for employees to have access to data, organizations must be nimble and adapt quickly to overcome these new problems that are arising”, said Derek Manky, Chief, Security Insights & Global Threat Alliances at Fortinet – Office of CISO.

Cyber criminals target internet users with “Maruti Suzuki 40th Anniversary Celebration” free gift scam

WhatsApp messages masquerading as an offer from Maruti Suzuki with links luring unsuspecting users with the promise of Maruti Suzuki 40th Anniversary

December 9, 2021

WhatsApp messages masquerading as an offer from Maruti Suzuki with links luring unsuspecting users with the promise of Maruti Suzuki 40th Anniversary Celebration presents, have been making the rounds on the app. If you receive such messages try to stay away from it, as it can be a scam.

The Research Wing of CyberPeace Foundation along with Autobot Infosec Private Limited have conducted a study based on a WhatsApp message that contained a link pretending to be a free gift offer from Maruti Suzuki which asks users to participate in a survey in order to get a chance to win a Maruti Baleno Sigma MT car.

Warning SignsThe campaign pretends to be an offer from Maruti Suzuki but is hosted on a third party domain instead of the official Maruti Suzuki website which makes it more suspicious.

The domain names associated with the campaign have been registered in very recent times.

Multiple redirections have been noticed between the links.

No reputed site would ask its users to share the campaign on WhatsApp.

The prize is kept really attractive to lure the laymen.

Grammatical mistakes have been noticed.

A congratulations message appears on the landing page with an attractive photo of Maruti Suzuki cars that asks users to participate in a quick survey in order to get a “Maruti Suzuki BALENO Sigma MT”. Also, the bottom of the page seems to appear like a comment section with public comments establishing the truthfulness of the offer.

The survey starts with some basic questions like Do you know Maruti Suzuki?, How old are you?, How do you think of Maruti Suzuki?, Are you male or female? Etc. Once the user answers the questions a “congratulatory message” is displayed.

On clicking the OK button users are given three attempts to win the prize. After completing all the attempts a message pops up that the user has won “Maruti Suzuki BALENO Sigma MT”. It then prompts the user to share the message on WhatsApp.

Strangely enough the user has to keep clicking the WhatsApp button until the progress bar completes. After clicking on the green ‘WhatsApp’ button multiple times it shows a section where an instruction has been given to complete registration in order to get the prize.

After clicking on the green ‘Complete registration’ button, it redirects the user to multiple advertisements web pages varying each time the user clicks on the button.

During the analysis the research team found a javascript code called hm.js was being executed in the background from the host hm[.]baidu[.]com which is a subdomain of Baidu and is used for Baidu Analytics, also known as Baidu Tongji. The important part is that Baidu is a Chinese multinational technology company specializing in Internet-related services, products and artificial intelligence, headquartered in Beijing’s Haidian district, China.To read the full report, please click (https://www.cyberpeace.org/CyberPeace/Repository/20210828Research-report-on-Maruti-Suzuki-40th-Anniversary-Celebration-free-gift-scam.pdf) here:

Conclusive Summary

1. The whole research activity was performed in a secured sandbox environment where the WhatsApp application was not installed. If any user opens the link from a device like smartphones where the WhatsApp application is installed, the sharing features on the site will open the Whatsapp application on the device to share the link.

2. The campaign collects browser and system information from the users.

3. Most of the domain names associated with the campaign have the registrant country as China.

4. Cybercriminals used Cloudflare technologies to mask the real IP addresses of the front-end domain names used in this Maruti Suzuki 40th Anniversary Celebration free gift campaign. But during the phases of investigation, the research team has identified a domain name that was requested in the background and has been traced as belonging to China.

CyberPeace Advisory

1. CyberPeace Foundation and Autobot Infosec recommend that people should avoid opening such messages sent via social platforms.

2. If at all, the user gets into this trap, it could lead to whole system compromise such as access to the microphone, Camera, Text Messages, Contacts, Pictures, Videos, Banking Applications, etc as well as financial losses.

3. Do not share confidential details like login credentials, banking information with such a type of scam.

4. Do not share or forward fake messages containing links without proper verification.

5. There is a need for International Cyber Cooperation between countries to bust the cybercriminal gangs running the fraud campaigns affecting individuals and organizations, to make Cyberspace resilient and peaceful.

Source: https://www.business-standard.com//content/press-releases-ani/cyber-criminals-target-internet-users-with-maruti-suzuki-40th-anniversary-celebration-free-gift-scam-121083101204_1.html

Apple WWDC 2023:The Unveiling Of The Innovation

In this blog, we will examine the exciting announcements made at Apple WWDC 2023, which was a ground-breaking event.

June 17, 2023

Introduction

The two-day Apple’s Worldwide Developer Conference (WWDC) 2023, which was held on the 6th & 7th of June, has become an essential and highly anticipated part of our calendar as frequently as the trend. This year’s keynote announcements will include all of the usual enhancements for iOS, iPadOS, watchOS, macOS, and more. However, this year is also unique due to the unveiling of the Vision Pro headset, a brand-new Apple product.

In this blog, we will examine the exciting announcements made at Apple WWDC 2023, which was a ground-breaking event.

macOS Sonoma

macOS Sonoma, the new presentation of macOS disclosed at the WWDC full of exciting features. It comes with stunning video screensavers that show stunning scenes from all over the world. Gadgets can now be added genuinely to the work area and adjusted totally based on the client’s action. Also, it changes variety and blurring out of the spotlight while utilising applications. In addition, Death Stranding: Directors Cut for Mac announced that the Game Mode is added to make Macs more suitable for gaming. A presenter overlay enhances video presentations, and viewers can respond to them with interactive responses. Updated Safari is also included in the WebApp feature that turns frequently used websites into dedicated windows, a new Profile system for separating browsing history, and secure password sharing. Currently, the developer beta is available and the public beta will be available in July, and the final release is anticipated for the fall.

ios 16

Apple WWDC 2023 shows the following iOS, and iOS 16 replication, offering plenty of energising highlights for iPhone and iPad clients. Apple maintains its commitment to privacy with iOS 16, which introduces enhanced privacy settings that give users even more control over their data and online privacy. Users can also personalise their devices according to their preferences thanks to the new operating system’s refinement and customisable user interface.Improved multitasking capabilities like redesigned Files app and advanced note-taking features are just a few of the productivity enhancements included in the iOS 16. With iOS 16, Apple also improves its AR capabilities, allowing developers to develop even more immersive and interactive AR experiences.

WatchOS 9

Apple WWDC 2023 carried energising updates to the Apple Watch with the presentation of watchOS 9. The Apple Watch is an essential companion for sustaining a healthy lifestyle because the most recent version of the operating system includes cutting-edge health and fitness features. WatchOS 9 gives users unprecedented control over their health, offering personalised fitness recommendations and advanced sleep tracking.

Additionally, new watch faces were added, enhancing communication capabilities and improving app performance in watchOS 9, making the Apple Watch even easier to use daily.

ios 17

Rather than focusing on major features, Apple focused on quality-of-life enhancements when it announced iOS 17 at WWDC 2023. Live Voicemail with real-time transcripts of voicemails, personalised personal contact “posters,” and video voicemails for FaceTime are all part of the update. Search filters, a catch-up arrow, live location sharing, and a safety feature called Check-In are all available in Messages. AirDrop now supports NameDrop for transferring contact information; stickers have been expanded. The autocorrect and recording features on the keyboard have been improved for accuracy. Standby in the lock screen is an intelligent home display that shows the weather, upcoming appointments, and notifications. Siri works on Standby and adjusts itself for the night. The developer beta is currently available now, and a public beta will take place next month before the full release is in the fall.

Vision Pro VR Headset

Apple unveiled the Vision Pro AR headset, their first foray into virtual reality (VR), during the WWDC keynote. The Vision Pro is a virtual reality headset that competes with PlayStation VR2 and Meta Quest 3. This is in contrast to the long-awaited Apple smart glasses. Apple put a lot of effort into making a thin and light headset by using premium materials when needed. Voice, hand, and eye commands are all used to operate the Digital Crown-equipped device. The showcases offer extraordinary clarity, which is fueled by Apple’s M2 processor with a committed R1 chip. The Vision Pro combines virtual reality (VR) and augmented reality (AR), enabling users to interact with Apple apps and gain access to the company’s existing ecosystem. The expanded reality space created by the headset’s sensors and cameras allows users to place apps in real-world environments and adjust their level of concentration. Optic ID is a security and unlocking eye-tracking technology that is incorporated into the Vision Pro. It allows for a more immersive screen experience because it is compatible with Apple accessories like Magic Keyboard and Mac. At launch, the Vision Pro supports over a hundred Apple game galleries. Disney gave a hint that Apple and Disney might work together in the future by announcing support for the Vision Pro and making the Disney Plus app available immediately. The show highlighted the headset’s lightweight plan and recommended Apple clients wear it for extended periods. However, widespread adoption may be difficult due to the high price of $3,499 (₹289,093.01 approx). Apple is expected to release the Vision Pro for public use in 2024.

15-inch MacBook Air

At the WWDC event, Apple revealed a new MacBook Air with a larger 15-inch model instead of the standard 13-inch model. The 15-inch MacBook Air features a powerful Apple M2 processor, a thin, light, and long-lasting design, and a stunning 15.3-inch Retina display. It comes in four colours and has a headphone jack, two USB-C ports, and MagSafe charging. The display has six spatial speakers, a 1080p webcam, and 500 nits of brightness. Apple claims a battery life of up to 18 hours.

Conclusion

At Apple’s 2023 WWDC, the company demonstrated its commitment to developing technology that is user-friendly and accessible to all. Apple’s commitment to improving the user experience across all of its products is demonstrated in the updates to operating systems, improvements of Siri, breakthroughs in augmented reality, and enhancements to health and fitness.By making complex innovations more like-minded and easy to understand, Apple is enabling people to use the maximum capacity of their gadgets. Apple’s innovations at WWDC 2023 are expected to shape the future of technology, simplifying everyday tasks and revolutionising how we interact with the digital world.As we push ahead, it is exciting to guess what these advancements will proceed to develop and decidedly mean for our lives. The future holds even more incredible possibilities for all of us because of Apple’s focus on privacy, user-centric design, and pushing the boundaries of innovation. Thus, prepare to embrace a future where innovation flawlessly incorporates into our lives because of the endeavours displayed at Apple WWDC 2023.

Exclusive Training Kits Boost Esports Players

Factors Shaping Esports in India: The Indian Esports world is thriving & growing day by day. Let’s dive in and take a look at what is shaping this culture.

May 25, 2023

Introduction

In recent years, India has witnessed a significant rise in the popularity and recognition of esports, which refers to online gaming. Esports has emerged as a mainstream phenomenon, influencing players and youngsters worldwide. In India, with the penetration of the internet at 52%, the youth has got its attracted to Esports. In this blog post, we will look at how the government is booting the players, establishing professional leagues, and supporting gaming companies and sponsors in the best possible manner. As the ecosystem continues to rise in prominence and establish itself as a mainstream sporting phenomenon in India.

Factors Shaping Esports in India: A few factors are shaping and growing the love for esports in India here. Let’s have a look.

Technological Advances: The availability and affordability of high-speed internet connections and smart gaming equipment have played an important part in making esports more accessible to a broader audience in India. With the development of smartphones and low-cost gaming PCs, many people may now easily participate in and watch esports tournaments.

Youth Demographic: India has a large population of young people who are enthusiastic gamers and tech-savvy. The youth demographic’s enthusiasm for gaming has spurred the expansion of esports in the country, as they actively participate in competitive gaming and watch major esports competitions.

Increase in the Gaming community: Gaming has been deeply established in Indian society, with many people using it for enjoyment and social contact. As the competitive component of gaming, esports has naturally gained popularity among gamers looking for a more competitive and immersive experience.

Esports Infrastructure and Events: The creation of specialised esports infrastructure, such as esports arenas, gaming cafés, and tournament venues, has considerably aided esports growth in India. Major national and international esports competitions and leagues have also been staged in India, offering exposure and possibilities for prospective esports players. Also supports various platforms such as YouTube, Twitch, and Facebook gaming, which has played a vital role in showcasing and popularising Esports in India.

Government support: Corporate and government sectors in India have recognised the potential of esports and are actively supporting its growth. Major corporate investments, sponsorships, and collaborations with esports organisations have supplied the financial backing and resources required for the country’s esports development. Government attempts to promote esports have also been initiated, such as forming esports governing organisations and including esports in official sporting events.

Growing Popularity and Recognition: Esports in India has witnessed a significant surge in viewership and fanbase, all thanks to online streaming platforms such as Twitch, YouTube which have provided a convenient way for fans to watch live esports events at home and at high-definition quality social media platforms let the fans to interact with their favourite players and stay updated on the latest esports news and events.

Esports Leagues in India

The organisation of esports tournaments and leagues in India has increased, with the IGL being one of the largest and most popular. The ESL India Premiership is a major esports event the Electronic Sports League organised in collaboration with NODWIN Gaming. Viacom18, a well-known Indian media business, established UCypher, an esports league. It focuses on a range of gaming games such as CS: GO, Dota 2, and Tekken in order to promote esports as a professional sport in India. All of these platforms provide professional players with a venue to compete and establish their profile in the esports industry.

India’s Performance in Esports to Date

Indian esports players have achieved remarkable global success, including outstanding results in prominent events and leagues. Individual Indian esports players’ success stories illustrate their talent, determination, and India’s ability to flourish in the esports sphere. These accomplishments contribute to the worldwide esports landscape’s awareness and growth of Indian esports. To add the name of the players and their success stories that have bought pride to India, they are Tirth Metha, Known as “Ritr”, a CS:GO player, Abhijeet “Ghatak”, Ankit “V3nom”, Saloni “Meow16K”.Apart from this Indian women’s team has also done exceptionally well in CS:GO and has made it to the finale.

Government and Corporate Sectors support: The Indian esports business has received backing from the government and corporate sectors, contributing to its growth and acceptance as a genuine sport.

Government Initiatives: The Indian government has expressed increased support for esports through different initiatives. This involves recognising esports as an official sport, establishing esports regulating organisations, and incorporating esports into national sports federations. The government has also announced steps to give financial assistance, subsidies, and infrastructure development for esports, therefore providing a favourable environment for the industry’s growth. Recently, Kalyan Chaubey, joint secretary and acting CEO of the IOA, personally gave the athletes cutting-edge training gear during this occasion, providing kits to the players. The kit includes the following:

Advanced gaming mouse.

Keyboard built for quick responses.

A smooth mousepad

A headphone for crystal-clear communication

An eSports bag to carry the equipment.

Corporate Sponsorship and Partnerships

Indian corporations have recognised esports’ promise and actively sponsored and collaborated with esports organisations, tournaments, and individual players. Companies from various industries, including technology, telecommunications, and entertainment, have invested in esports to capitalise on its success and connect with the esports community. These sponsorships and collaborations give financial support, resources, and visibility to esports in India. The leagues and championships provide opportunities for young players to showcase their talent.

Challenges and future

While esports provides great job opportunities, several obstacles must be overcome in order for the industry to expand and gain recognition:

Infrastructure & Training Facilities: Ensuring the availability of high-quality training facilities and infrastructure is critical for developing talent and allowing players to realise their maximum potential. Continued investment in esports venues, training facilities, and academies is critical for the industry’s long-term success.

Fostering a culture of skill development and giving outlets for formal education in esports would improve the professionalism and competitiveness of Indian esports players. Collaborations between educational institutions and esports organisations can result in the development of specialised programs in areas such as game analysis, team management, and sports psychology.

Establishing a thorough legal framework and governance structure for esports will help it gain legitimacy as a professional sport. Clear standards on player contracts, player rights, anti-doping procedures, and fair competition policies are all part of this.

Conclusion

Esports in India provide massive professional opportunities and growth possibilities for aspiring esports athletes. The sector’s prospects are based on overcoming infrastructure, perception, talent development, and regulatory barriers. Esports may establish itself as a viable and acceptable career alternative in India with continued support, investment, and stakeholder collaboration

How Safe Is BharOS? What Do Cybersecurity Experts Say? You Are About To Find Out

Is this 'Made in India' Mobile OS Truly Secure? Cybersecurity Experts Share Insights on BharOS.

February 11, 2023

BharOS’s successful testing grabbed massive online attention after Ashwini Vaishnaw, Minister of Communications and Electronics & IT, and Union Education Minister Dharmendra Pradhan unveiled the new mobile operating system. On Data Privacy Day, January 28, it’s appropriate to discuss the safety factors.

The OS is developed by JandKops, which has been incubated by IIT Madras Pravartak Technologies Foundation. It is claimed that BharOS will ensure the prevention of the “execution of any malware” and “execution of any malicious application”.

Even though it is called a Made in India OS, there are many people who disagree with this. It is because the OS is based on an AOSP (Android Open Source Project). It includes similar methodologies, functionalities, and basics used in Google Android.

Global safety factor

Security and data safety has been worldwide issue. A few years ago, Alphabet CEO Sundar Pichai also testified in front of US Congress while facing questions related to privacy, data collection, and location tracking.

While experts say that Android’s app ecosystem is a privacy and security disaster, a study that examined 82,501 apps pre-installed on 1,742 Android smartphones sold by 214 vendors concluded that users are woefully unaware of the significant security and privacy risks posed by pre-installed applications.

Even Apple, which takes cybersafety issues as a top priority, sometimes finds itself in a vulnerable situation. For example, last year Apple users were advised to update their devices to protect against a pair of security flaws that could allow attackers to take complete control.

It was said that one of the software flaws affected the kernel, the deepest layer of the OS shared by all Apple devices, while the other had an impact on WebKit, the technology that powers the Safari web browser.

Security researchers, including NordVPN, said that Apple’s closed development OS makes it more difficult for hackers to develop exploits, while Android raises the threat level since anyone can see its source code to develop exploits.

BharOS is not like iOS but it is kind of similar to Android and based on AOSP. So the question is, how safe would this OS be?

‘Security blanket’

Sandip Kumar Panda, Co-founder and CEO of InstaSafe, told News18: “BharOS acts as a security blanket for devices. The framework is designed in a manner that it prevents the execution of any malicious app and verifies each app on the devices before making it live on the BharOS platform.”

There are no apps without any vulnerabilities, he said. “As the app development progresses, vulnerabilities get introduced either in the form of insecure coding practices or third-party software vulnerabilities integrated with the platform. Since several Android vulnerabilities were discovered over the years, all those bugs would have been fixed now and updates would already have been for AOSP, which will be much more mature now,” he added.

Vineet Kumar, Founder and President of CyberPeace Foundation, believes that “the use of AOSP as the foundation for BharOS is a positive step” as it is a robust platform.

But according to him, it is important to note that no OS can be completely immune to all forms of cyber threats. “The key to staying safe online is to stay vigilant, use security software, keep your software updated, and be mindful of the apps you install and the websites you visit,” he said,

Furthermore, the expert stated that it is possible to make an OS more secure by implementing a variety of security features and technologies such as sandboxing, whitelisting, and application control, as well as rigorous testing and code review processes.

Kumar said: “It would be important for an independent, reputable security firm to evaluate BharOS and test its security features before it can be stated with certainty that it is more secure than other OSs.”

It is difficult to say whether the BharOS will be free of cybersecurity issues without more information about the specific features and security measures that have been implemented, he noted while adding that this OS has to go through a rigorous testing and certification process.

“It will be important to see how it measures up against established security standards and how well it can withstand real-world attacks,” the expert stated.

‍

Reference Link : https://www.news18.com/amp/news/tech/data-privacy-day-how-safe-is-bharos-what-do-cybersecurity-experts-say-you-are-about-to-find-out-6932521.html

iOS vs. Android - 2023

UI, app selection, performance, security - who does it better? Android or iOS? Learn more about what these tech giants have to offer in today's landscape.

January 30, 2023

Introduction

The world has been surfing the wave of technological advancements and innovations for the past decade, and it all pins down to one device – our mobile phone. For all mobile users, the primary choices of operating systems are Android and iOS. Android is an OS created by google in 2008 and is supported by most brands like – One+, Mi, OPPO, VIVO, Motorola, and many more and is one of the most used operating systems. iOS is an OS that was developed by Apple and was introduced in their first phone – The iPhone, in 2007. Both OS came into existence when mobile phone penetration was slow globally, and so the scope of expansion and advancements was always in favor of such operating systems.

The Evolution

iOS

Ever since the advent of the iPhone, iOS has seen many changes since 2007. The current version of iOs is iOS 16. However, in the course of creating new iOS and updating the old ones, Apple has come out with various advancements like the App Store, Touch ID & Face ID, Apple Music, Podcasts, Augmented reality, Contact exposure, and many more, which have later become part of features of Android phone as well. Apple is one of the oldest tech and gadget developers in the world, most of the devices manufactured by Apple have received global recognition, and hence Apple enjoys providing services to a huge global user base.

Android

The OS has been famous for using the software version names on the food items like – Pie, Oreo, Nougat, KitKat, Eclairs, etc. From Android 10 onwards, the new versions were demoted by number. The most recent Android OS is Android 13; this OS is known for its practicality and flexibility. In 2012 Android became the most popular operating system for mobile devices, surpassing Apple’s iOS, and as of 2020, about 75 percent of mobile devices run Android.

Android vs. iOS

1. USER INTERFACE

One of the most noticeable differences between Android and iPhone is their user interface. Android devices have a more customizable interface, with options to change the home screen, app icons, and overall theme. The iPhone, on the other hand, has a more uniform interface with less room for customization. Android allows users to customize their home screen by adding widgets and changing the layout of their app icons. This can be useful for people who want quick access to certain functions or information on their home screen. IOS does not have this feature, but it does allow users to organize their app icons into folders for easier navigation.

2. APP SELECTION

Another factor to consider when choosing between Android and iOS is the app selection. Both platforms have a wide range of apps available, but there are some differences to consider. Android has a larger selection of apps overall, including a larger selection of free apps. However, some popular apps, such as certain music streaming apps and games, may be released first or only available on iPhone. iOS also has a more curated app store, meaning that all apps must go through a review process before being accepted for download. This can result in a higher quality of apps overall, but it can also mean that it takes longer for new apps to become available on the platform. iPhone devices tend to have less processing power and RAM. But they are generally more efficient in their use of resources. This can result in longer battery life, but it may also mean that iPhones are slower at handling multiple tasks or running resource-intensive apps.

3. PERFORMANCE

When it comes to performance, both Android and iPhone have their own strengths and weaknesses. Android devices tend to have more processing power and RAM. This can make them faster and more capable of handling multiple tasks simultaneously. However, this can also lead to Android devices having shorter battery life compared to iPhones.

4. SECURITY

Security is an important consideration for any smartphone user, and Android and iPhone have their own measures to protect user data. Android devices are generally seen as being less secure than iPhones due to their open nature. Android allows users to install apps from sources other than the Google Play Store, which can increase the risk of downloading malicious apps. However, Android has made improvements in recent years to address this issue. Including the introduction of Google Play Protect, which scans apps for malware before they are downloaded. On the other hand, iPhone devices have a more closed ecosystem, with all apps required to go through Apple‘s review process before being available for download. This helps reduce the risk of downloading malicious apps, but it can also limit the platform’s flexibility.

Conclusion

The debate about the better OS has been going on for some time now, and it looks like it will get more comprehensive in the times to come, as netizens go deeper into cyberspace, they will get more aware and critical of their uses and demands, which will allow them to opt for the best OS for their convenience. Although the Andriod OS, due to its integration, stands more vulnerable to security threats as compared to iOS, no software is secure in today’s time, what is secure is its use and application hence the netizen and the platforms need to increase their awareness and knowledge to safeguard themselves and the wholesome cyberspace.

Uber and GeM

It made a remarkable start in India in 2017 and, since then, has seen a rise in the customers and drivers for the company.

June 2, 2023

Introduction

Established in the US, one of the world’s largest cab networks came into existence in 2010 and, since its inception, has expanded all over the globe with operations in 10,000 cities across 71 countries. It made a remarkable start in India in 2017 and, since then, has seen a rise in the customers and drivers for the company. India is among the largest markets for Uber, with 600,000 monthly drivers and 8.5 million monthly riders.

GeM

Government e-Marketplace (GeM) is a one-stop portal to facilitate online procurement of common-use Goods & Services required by various Government Departments / Organizations / PSUs. GeM aims to enhance transparency, efficiency and speed in public procurement. It provides the tools of e-bidding, reverses e-auction and demand aggregation to facilitate government users achieve the best value for their money. Government e-Marketplace owes its genesis to the recommendations of two Groups of Secretaries to the Prime Minister in January 2016. They recommended setting up a dedicated e-market for different goods & services procured or sold by Government/PSUs besides reforming DGS&D. Subsequently, the Finance Minister, in his Budget speech for FY 2016-17, announced setting up of a technology-driven platform to facilitate procurement of goods and services by various Ministries and agencies of the Government. The portal was launched on 9th August 2016 by the Commerce & Industry Minister.

Uber-GeM collaboration

The cab network giant has registered on the portal of the Government E-marketplace and has declared that it will offer its services to Government officials from Ministries and PSUs. The project is currently in its pilot phase and shall be executed systematically to cover all the ministries and PSUs in the nation. The officials can book cabs at a fixed price with no cancellation or surge fees on the rides. The authorised officials will be able to book a cab from the portal and select from the list of drivers available. It will be a cashless/cardless ride for the officials; additional vehicle categories for government riders have been added, namely, GeM Yatraa Hatch and GeM Yatraa Sedan, and there will be hourly rentals for multiple-stops, allowing the government officials to enjoy the flexible and easily accessible network of cabs in major cities.

Advantages

Such collaboration between Government institutions and corporates will go a long way to secure a stable equilibrium in the market. Uber, a US-based company, enjoys a vast user base in India and has created new job avenues. The advantages of the collaboration between GeM and Uber are as follows-

Easy accessibility

This will undoubtedly provide ease in accessibility in terms of being in a new place, and language barriers will no longer exist with such options for Government officials.

Increased jobs for drivers

With more cabs being engaged with ministries and PSUs, it is pertinent that the requirement for drivers will grow, thus increasing the employability rate in India and allowing the user to have an uninterrupted experience.

Ease of travel and commuting

This move will provide flexibility, thus leading to more ease in travel in cases of emergencies or places inaccessible by trains or other modes of transport.

Rise in travel and tourism

Coupled with the other factors, the opportunities for the users to visit different places will be an added advantage which will help boost the tourism industry, thus creating a balance in the market.

Sustainable Government corporate relationship

Such collaborations between the government and corporates will be substantial, signifying the ease of doing business in India. They will also act as a beacon of example for compliance with opportunities for the other companies and stakeholders.

Opportunities for collaboration with ingenious start-ups

With such major corporate joining hands with the government, the indigenous start-ups will have various opportunities to engage with companies and recreate similar businesses rooted in India, thus transforming the economy.

Conclusion

Transportation and communication play a vital role in our lives, thus, such collaboration will go a long way in creating a better and more uniform user experience in the country. This also goes a long way to showcase that the Governmental platforms also offer services of a global standard. Such portals exist in South Korea, Singapore, the US and Europe. The network of cabs can only be sustained using the locals as drivers, hence these collaborations are win-win for all as the market dynamics are improving, employability will increase, and improved user experience will be seen.

UNION BUDGET 2023 “Centers of Excellence for Artificial Intelligence”

Education, Healthcare, and Agriculture: India's AI Revolution to Rise with 3 Centers of Excellence in the Union Budget 2023.

February 15, 2023

THREE CENTRES OF EXCELLENCE IN ARTIFICIAL INTELLIGENCE:

India’s Finance Minister, Mrs. Nirmala Sitharaman, with a vision of ‘Make AI for India’ and ‘Make AI work for India, ’ announced during the presentation of Union Budget 2023 that the Indian Government is planning to set up three ‘Centre of Excellence’ for Artificial Intelligence in top Educational Institutions to revolutionise fields such as health, agriculture, etc.

Under the ‘Amirt Kaal,’ i.e., the budget of 2023 is a stepping stone by the government to have a technology-driven knowledge-based economy and the seven priorities that have been set up by the government called ‘Saptarishi’ such as inclusive development, reaching the last mile, infrastructure investment, unleashing potential, green growth, youth power, and financial sector will guide the nation in this endeavor along with leading industry players that will partner in conducting interdisciplinary research, developing cutting edge applications and scalable problem solutions in such areas.

The government has already formed the roadmap for AI in the nation through MeitY, NASSCOM, and DRDO, indicating that the government has already started this AI revolution. For AI-related research and development, the Centre for Artificial Intelligence and Robotics (CAIR) has already been formed, and biometric identification, facial recognition, criminal investigation, crowd and traffic management, agriculture, healthcare, education, and other applications of AI are currently being used.

Even a task force on artificial intelligence (AI) was established on August 24, 2017. The government had promised to set up Centers of Excellence (CoEs) for research, education, and skill development in robotics, artificial intelligence (AI), digital manufacturing, big data analytics, quantum communication, and the Internet of Things (IoT) and by announcing the same in the current Union budget has planned to fulfill the same.

The government has also announced the development of 100 labs in engineering institutions for developing applications using 5G services that will collaborate with various authorities, regulators, banks, and other businesses.

Developing such labs aims to create new business models and employment opportunities. Among others, it will also create smart classrooms, precision farming, intelligent transport systems, and healthcare applications, as well as new pedagogy, curriculum, continual professional development dipstick survey, and ICT implementation will be introduced for training the teachers.

POSSIBLE ROLES OF AI:

The use of AI in top educational institutions will help students to learn at their own pace, using AI algorithms providing customised feedback and recommendations based on their performance, as it can also help students identify their strengths and weaknesses, allowing them to focus their study efforts more effectively and efficiently and will help train students in AI and make the country future-ready.

The main area of AI in healthcare, agriculture, and sustainable cities would be researching and developing practical AI applications in these sectors. In healthcare, AI can be effective by helping medical professionals diagnose diseases faster and more accurately by analysing medical images and patient data. It can also be used to identify the most effective treatments for specific patients based on their genetic and medical history.

Artificial Intelligence (AI) has the potential to revolutionise the agriculture industry by improving yields, reducing costs, and increasing efficiency. AI algorithms can collect and analyse data on soil moisture, crop health, and weather patterns to optimise crop management practices, improve yields and the health and well-being of livestock, predict potential health issues, and increase productivity. These algorithms can identify and target weeds and pests, reducing the need for harmful chemicals and increasing sustainability.

ROLE OF AI IN CYBERSPACE:

Artificial Intelligence (AI) plays a crucial role in cyberspace. AI technology can enhance security in cyberspace, prevent cyber-attacks, detect and respond to security threats, and improve overall cybersecurity. Some of the specific applications of AI in cyberspace include:

Intrusion Detection: AI-powered systems can analyse large amounts of data and detect signs of potential cyber-attacks.
Threat Analysis: AI algorithms can help identify patterns of behaviour that may indicate a potential threat and then take appropriate action.
Fraud Detection: AI can identify and prevent fraudulent activities, such as identity theft and phishing, by analysing large amounts of data and detecting unusual behaviour patterns.
Network Security: AI can monitor and secure networks against potential cyber-attacks by detecting and blocking malicious traffic.
Data Security: AI can be used to protect sensitive data and ensure that it is only accessible to authorised personnel.

CONCLUSION:

Introducing AI in top educational institutions and partnering it with leading industries will prove to be a stepping stone to revolutionise the development of the country, as Artificial Intelligence (AI) has the potential to play a significant role in the development of a country by improving various sectors and addressing societal challenges. Overall, we hope to see an increase in efficiency and productivity across various industries, leading to increased economic growth and job creation, improved delivery of healthcare services by increasing access to care and, improving patient outcomes, making education more accessible and effective as AI has the potential to improve various sectors of a country and contribute to its overall development and progress. However, it’s important to ensure that AI is developed and used ethically, considering its potential consequences and impact on society.

References:

G-20 India’s Presidency and Cybersecurity Enterprises

India's Digital Innovation Alliance: Bridging digital gaps to build a sustainable future for international cybersecurity.

January 17, 2023

Introduction

It’s a proud moment for Indians that India will host the G- 20 administration, which will bring the world’s 20 largest profitable nations together on a single platform during the post-economic recovery and the Russia- Ukraine conflict, which has increased geopolitical pressures among nations over the last many times and made the G- 20 a precedence of nations. With this administration, India has to make cybersecurity precedence, as the security and integrity of the critical structure and digital platforms are top precedence in 2023. The necessity for a secure cyberspace is pivotal given the exponential increase in the volume and kind of cyber-attacks, particularly to crucial structures the most recent illustration is the ongoing interruption at New Delhi’s All India Institute of Medical lores caused by a ransomware assault. It has been observed that the mode of attacks are more sophisticated and targets communication structure, critical structure, transport systems, and especially the information technology sector and fiscal system.

The structure that enables the delivery of government services to be more effective. As a result,cyber-secured critical structures and digital public forums are necessary for public security, bettered governance, and, most importantly, maintaining people’s trust. The G20 can be enhanced and contribute towards securing digital public platforms and the integrity of the critical structure. This time, in 2023, digital security is the top precedence.

G20 cybersecurity enterprises and politic sweat

The emphasis on cybersecurity was maintained throughout the Italian and Indonesian regulations in 2021 and 2022, independently, by emphasizing the significance of cyberspace during Digital Economy Working Group addresses. Specifically, under the Indonesian Presidency, the prominent cybersecurity focus was clear in the recent Bali Leaders’ protestation, which noted, among other effects, the significance of fighting misinformation juggernauts and cyber attacks, as well as guaranteeing connectivity structure security. The cyber incident report by the Financial Stability Board on carrying further uniformity in cyber incident reporting In 2016, a G20 digital task force was created under the Chinese administration to understand digital technology issues. Under the Saudi administration, the cybersecurity gap at the G20 was bridged by addressing the issues of MSMs. India has also refocused on the significance of creating secure, secure, and stronger-friendly digital platforms.

G20- India’s digital invention alliance( G-20-DIA) a cyber-secure Bharat

Under India’s administration, the G20’s Digital Economy Working Group is led by the Ministry of Electronics and Information Technology( MeitY, DEWG).
The Ministry concentrated on three major areas during India’s G20 administration digital skill development, digital public structure, and cyber security.
The EWG’s DIA and Stay Safe Online enterprise further the ideal of lesser digital metamorphosis by guaranteeing a safe and creative cyber terrain. They want to offer a smooth and secure delivery of public services.

The G20 Digital Innovation Alliance

(G20- DIA) strives to find, admit, and encourage the relinquishment of innovative and poignant digital technologies produced by invited G20 startups and-member governments.

These technologies must meet humanity’s conditions in six crucial areas husbandry, health, education, finance, secure digital structure, and indirect frugality.
The inventions created around these motifs will be supported by the Digital Public Goods structure, allowing them to be espoused encyclopedically, closing the digital gap and icing sustainable and indifferent growth.
The G20 Digital Innovation Alliance( G20- DIA) conference will be held on the perimeters of the Digital Economy Working Group( DEWG) meeting in Bengaluru.
Top-nominated entrepreneurs from each order will present their ideas to a worldwide community of investors, instructors, pots, and other stakeholders at this event.

India’s” Stay Safe Online crusade”

The” Stay Safe Online” crusade attempts to raise mindfulness about the significance of remaining safe in the online world amid our adding reliance on it. With the fast expansion of the technical terrain and the growing number of internet druggies in India, new difficulties are arising. The Stay Safe Online crusade aims to educate individuals about cyber pitfalls and how to avoid them. The time-long crusade will target children, women, scholars, and aged citizens, as well as individuals with disabilities, preceptors, and government officers in particular. It’ll be done in Hindi, English, and indigenous languages to reach a larger followership. It’ll distribute mindfulness information in infographics, short pictures, cartoon stories, and so on through extensively employed social media platforms and other channels. The primary stakeholders will be government agencies, civil societies, and NGOs.

Conclusion

To wind up, it can be said that cyber security has become the most essential part of transnational affairs. As India hosts the G20 administration in 2023, the docket relating to cybersecurity gains a global stage, where cyber-related issues are addressed and honored encyclopedically, and nations can combat these issues; also, India aims to raise cyber mindfulness among its citizens.

Online Gaming Regulations 2022 : Unlocking a New Level

India's Gaming Revolution: Esports Integration with the Regulatory Bill 2022. Discover how India is embracing Esports and supporting the gamer community.

January 4, 2023

Introduction

The year, 2022 has been a year of transition and change for the gaming industry. This year esports and gaming including the industry’s greater increased acceptance by the sports authorities and higher prize pools for top players, has been more commercial than ever, according to research by the year 2025 the industry will witness growth by 5 million dollars and around 420 million active gamers from India. Since, India is on the way to become world’s largest gaming market, with revenue earned in 2021 increasing by up to 28%, or 1.2 billion dollars, and predicted to reach 2 billion dollars by 2024 as a result of the COVID-19 expanding internet access throughout the country.

After a lengthy debate, the government has finally decided to bring online gaming under the purview of the law. The President of India has changed the rules governing e-sports and requested that the Sports Ministry and the Ministry of Electronics and Information Technology (MeitY) include e-sports in multi-sport competitions. India’s gaming sector has reached new heights this year, with the country winning its first bronze medal in the first esports event organized by this year’s Commonwealth Games, and this is only the beginning.

Indian government takes on E-sports

The Indian government has given esports a huge boost. It has been introduced into the traditional sports disciplines of the nation. Droupadi Murmu, the President of India, changed the regulations governing eSports using the authority “conferred by clause (3) of Article 77 of the Constitution,” and requested that “e-Sports be included as part of multi-sports events” from the Ministries of Electronics and Information Technology and Sports. Some crucial points will clarify the government’s position on e-sports.

E-sports were added as a demonstration sport to the 2018 Asian Games in Jakarta, which meant that medals earned in the sport were not counted in the official total of medals.
There is a greater desire for Esports to be integrated with school curricula.
E-Sports (Electronic Sports) have been acknowledged by the Indian government as a component of multi-sport tournaments.

Why is e-sports important?

The Indian Esports Industry has worked hard to distinguish Esports from the broader category of “Gaming.” Esports is a competitive sport in which esports athletes compete in specific video game genres in a virtual, electronic environment using their physical and mental prowess, according to the industry.

According to studies, as individuals have gotten more screen aware and online gaming has become a part of their life, internet gaming not only improves fine motor skills but also sharpens the mind. The industry has the most users and stakeholders, and it has become critical to governing it; consequently, legislation is required to regulate it.

The online regulation bill 2022

The Online Gaming (Regulations) Bill, 2022, was recently filed in the Lok Sabha to create an effective regulatory mechanism for the online gaming business to prevent fraud and misuse of things related to or incidental to it. There are 20 sections spread throughout three chapters. It intends to establish an Online Gaming Commission, the authority, mandate, and jurisdiction of which will be specified by the Bill. An online gaming server will be licensed, relinquished, revoked, or suspended by the Commission’s key highlights of the bill to make it more clear

The Bill establishes a regulating agency, the Online Gaming Commission (“OGC”), comprised of five members chosen by the Central Government, each with at least one specialist in the fields of law, cyber technology, and law enforcement experience.
The OGC will be able to oversee the functions of online gaming websites, issue periodic or special reports on Online Gaming issues, recommend appropriate measures to control and curb illegal Online Gaming, grant, suspend, and revoke licenses for online gaming websites, and set fees for license applications and renewals.
Without a website and a non-transferable and non-assignable license, the Bill proposes to make online gambling illegal. Anyone operating an online gaming server or website without a license risks up to three years in prison and a fine. The permission will be good for a six-year term.
The license intended to be given under the Bill may be terminated or canceled if the licensee violates any of the license’s requirements or any of Bill’s provisions. However, the Bill does not apply to anybody providing backend services in India, including hosting and maintenance for any international gaming website situated outside of India.
The bill also mentions the Foreign Direct Investment and Technology Collaboration in Online Gaming

Few misses in the bill that can be addressed to make it stronger and a better version

The law does not address Know Your Customer (KYC) requirements, customer complaint procedures, advertising and marketing restrictions, user data protection, responsible gaming guidelines, and other concerns.
In the bill, there is no clear distinction between money involved in the game. This is a matter of concern and needs to be addressed so the money laundering aspect can be determined.
The distinction between “games of chance” and “games of skill” is not addressed in the Bill. Furthermore, the Bill does not specify whether its prohibitions apply only to for-real-money games or to free games.‍

Conclusion

Despite the bill’s flaws, it has offered optimism to the burgeoning gaming sector, which desperately needs a robust regulatory and legal framework free of ambiguity, allowing players to play safely, and encouraging entrepreneurs to enter the field with safety and security. An improved regulatory framework will increase job prospects while also assisting the government. A transparent framework will also aid in the protection of the rights of actors and stakeholders.

Cyber Laws and Banking Industry

With the increasing reliance on digital technologies in the banking industry, cyber threats have become a significant concern.

June 24, 2023

Introduction

With the increasing reliance on digital technologies in the banking industry, cyber threats have become a significant concern. Cyberlaw plays a crucial role in safeguarding the banking sector from cybercrimes and ensuring the security and integrity of financial systems.

The banking industry has witnessed a rapid digital transformation, enabling convenient services and greater access to financial resources. However, this digitalisation also exposes the industry to cyber threats, necessitating the formulation and implementation of effective cyber law frameworks.

Recent Trends in the Banking Industry

Digital Transformation: The banking industry has embraced digital technologies, such as mobile banking, internet banking, and financial apps, to enhance customer experience and operational efficiency.

Open Banking: The concept of open banking has gained prominence, enabling data sharing between banks and third-party service providers, which introduces new cyber risks.

How Cyber Law Helps the Banking Sector

The banking sector and cyber crime share an unspoken synergy due to the mass digitisation of banking services. Thanks to QR codes, UPI and online banking payments, India is now home to 40% of global online banking transactions. Some critical aspects of the cyber law and banking sector are as follows:

Data Protection: Cyberlaw mandates banks to implement robust data protection measures, including encryption, access controls, and regular security audits, to safeguard customer data.

Incident Response and Reporting: Cyberlaw requires banks to establish incident response plans, promptly report cyber incidents to regulatory authorities, and cooperate in investigations.

Customer Protection: Cyberlaw enforces regulations related to online banking fraud, identity theft, and unauthorised transactions, ensuring that customers are protected from cybercrimes.

Legal Framework: Cyberlaw provides a legal foundation for digitalisation in the banking sector, assuring customers that regulations protect their digital transactions and data.

Cybersecurity Training and Awareness: Cyberlaw encourages banks to conduct regular training programs and create awareness among employees and customers about cyber threats, safe digital practices, and reporting procedures.

RBI Guidelines

The RBI, as India’s central banking institution, has issued comprehensive guidelines to enhance cyber resilience in the banking industry. These guidelines address various aspects, including:

Technology Risk Management

Cyber Security Framework

IT Governance

Cyber Crisis Management Plan

Incident Reporting and Response

Recent Trends in Banking Sector Frauds and the Role of Cyber Law

Phishing Attacks: Cyberlaw helps banks combat phishing attacks by imposing penalties on perpetrators and mandating preventive measures like two-factor authentication.

Insider Threats: Cyberlaw regulations emphasise the need for stringent access controls, employee background checks, and legal consequences for insiders involved in fraudulent activities.

Ransomware Attacks: Cyberlaw frameworks assist banks in dealing with ransomware attacks by enabling legal actions against hackers and promoting preventive measures, such as regular software updates and data backups.

Master Directions on Cyber Resilience and Digital Payment Security Controls for Payment System Operators (PSOs)

Draft of Master Directions on Cyber Resilience and Digital Payment Security Controls for Payment System Operators (PSOs) issued by the Reserve Bank of India (RBI). The directions provide guidelines and requirements for PSOs to improve the safety and security of their payment systems, with a focus on cyber resilience. These guidelines for PSOs include mobile payment service providers like Paytm or digital wallet payment platforms.

Here are the highlights-

The Directions aim to improve the safety and security of payment systems operated by PSOs by providing a framework for overall information security preparedness, with an emphasis on cyber resilience.

The Directions apply to all authorised non-bank PSOs.

PSOs must ensure adherence to these Directions by unregulated entities in their digital payments ecosystem, such as payment gateways, third-party service providers, vendors, and merchants.

The PSO’s Board of Directors is responsible for ensuring adequate oversight over information security risks, including cyber risk and cyber resilience. A sub-committee of the Board may be delegated with primary oversight responsibilities.

PSOs must formulate a Board-approved Information Security (IS) policy that covers roles and responsibilities, measures to identify and manage cyber security risks, training and awareness programs, and more.

PSOs should have a distinct Board-approved Cyber Crisis Management Plan (CCMP) to detect, contain, respond, and recover from cyber threats and attacks.

A senior-level executive, such as a Chief Information Security Officer (CISO), should be responsible for implementing the IS policy and the cyber resilience framework and assessing the overall information security posture of the PSO.

PSOs need to define Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) to identify potential risk events and assess the effectiveness of security controls. The sub-committee of the Board is responsible for monitoring these indicators.

PSOs should conduct a cyber risk assessment when launching new products, services, technologies, or significant changes to existing infrastructure or processes.

PSOs, including inventory management, identity and access management, network security, application security life cycle, security testing, vendor risk management, data security, patch and change management life cycle, incident response, business continuity planning, API security, employee awareness and training, and other security measures should implement various baseline information security measures and controls.

PSOs should ensure that payment transactions involving debit to accounts conducted electronically are permitted only through multi-factor authentication, except where explicitly permitted/relaxed.

Conclusion

The relationship between cyber law and the banking industry is crucial in ensuring a secure and trusted digital environment. Recent trends indicate that cyber threats are evolving and becoming more sophisticated. Compliance with cyber law provisions and adherence to guidelines such as those provided by the RBI is essential for banks to protect themselves and their customers from cybercrimes. By embracing robust cyber law frameworks, the banking industry can foster a resilient ecosystem that enables innovation while safeguarding the interests of all stakeholders or users.

Protecting Policyholders in the Digital Age

The insurance industry is a target for cybercriminals due to the sensitive nature of the information it holds.

June 10, 2023

Introduction

The insurance industry is a target for cybercriminals due to the sensitive nature of the information it holds. This makes it essential for insurance companies to have robust cybersecurity measures to protect their data and customers’ personal information.

Cyber fraud in India’s insurance industry is increasing. It is reported that the Indian insurance sector has witnessed a surge in cyber-attacks, with several instances of data breaches, identity thefts, and financial fraud being reported. These cybercrimes not only pose a significant threat to the financial stability of the insurance industry but also to the privacy and security of policyholders.

Cyber Frauds in the Insurance Industry

The insurance industry in India has been the target of increasing cyber fraud in recent years. With the growing digital transformation trend, insurance companies have become increasingly vulnerable to cyber-attacks. Cyber frauds in the insurance industry are initiated by hackers who use various techniques such as phishing, malware, ransomware, and social engineering to gain unauthorised access to policyholders’ personal data and sensitive information

Kinds of cyber frauds in the insurance industry

It is essential for insurers and policyholders alike to be aware of these kinds of cyber-attacks on insurance companies in today’s digital age. Staying educated about these threats can help prevent them from happening in the future.

Identity theft– One common type of cyber fraud that occurs in the insurance industry is identity theft. In this type of fraud, criminals steal personal information such as name, address, date of birth and social security numbers through phishing emails or fraudulent websites. They then use this information to open fraudulent policies or access existing ones.

Payment fraud- Another type of cyber fraud that is on the rise is payment fraud. In this type of fraud, hackers intercept electronic payments made by policyholders or agents using fake bank accounts or compromised payment gateways. The money is then siphoned into untraceable accounts, making it difficult for law enforcement agencies to identify and arrest the perpetrators.

Phishing attacks- Where the fraudsters posed as company officials and sent emails to policyholders requesting their account details. The unsuspecting customers fell for this scam and shared their sensitive information, which was then used to access their accounts and steal funds.

Hacking- Where hackers breach the company’s system to gain access to policyholder data. The hackers’ stoles personal records, including names, addresses, phone numbers, social security numbers, and financial information, which they later sell on the dark web.

Fake policies scam- Fraudsters create fake policies using stolen identities and collect premiums from innocent customers. The insurer then voided these policies due to fraudulent activity leaving those people without valid coverage when they needed it most. The victims suffer significant financial losses due to this scam.

Fake Insurance Websites- Discuss the creation of deceptive websites that imitate well-known insurance companies, where unsuspecting individuals provide their personal details, leading to identity theft or financial losses.

Prevention of Cyber Frauds in the Insurance Industry- Best practices to follow

Prevention is better than cure, which also holds true in the case of cyber fraud in the insurance industry. The industry must take proactive steps to prevent such frauds from occurring in the first place. One of the most effective ways to do so is by investing in cybersecurity measures that are specifically designed for the insurance sector.

Insurance companies must conduct regular employee training programs on cybersecurity best practices. This includes educating employees on how to identify and avoid phishing emails, create strong passwords, and recognise potential cyber threats. Companies should also establish a reporting mechanism for employees to report suspicious activity or incidents immediately.

Having proper access controls in place is also necessary. This means limiting access to sensitive data only to those employees who need it, implementing two-factor authentication, and regularly monitoring user activity logs. Regular audits can also provide an extra layer of protection against potential threats by identifying vulnerabilities that may have been overlooked during routine security checks.

Another essential step is encrypting all data transmitted between different systems and devices. Encryption scrambles data into unreadable codes that can only be deciphered using a decryption key, making it difficult for hackers to intercept or steal information in transit.

Legal Framework for Cyber Frauds in the Insurance Industry

The legal framework for cyber fraud in the insurance industry is critical to preventing such crimes. The Insurance Regulatory and Development Authority of India (IRDAI) has issued guidelines for insurers to establish a cybersecurity framework. The guidelines require insurers to conduct regular risk assessments, implement security measures, and ensure compliance with data privacy laws.

The Information Technology Act 2000, is another significant piece of legislation dealing with cyber fraud in India. The act defines offences such as unauthorised access to a computer system, hacking, and tampering with data. It also provides for stringent penalties and imprisonment for those found guilty of such offences.

The IRDAI’s guidelines provide insurers with a roadmap to establish robust cybersecurity measures to help prevent cyber fraud in the insurance industry. Stringent implementation of these guidelines will go a long way in safeguarding sensitive customer information from falling into the wrong hands.

Best Practices for Insurers and Policyholders

Insurers:

Implementing Strong Authentication: Encouraging the use of multi-factor authentication and secure login processes to safeguard customer accounts and prevent unauthorised access.

Regular Employee Training: Conduct cybersecurity awareness programs to educate employees about the latest threats and preventive measures.

Investing in Advanced Technologies: Utilizing robust cybersecurity tools and systems to promptly detect and mitigate potential cyber threats.

Policyholders:

Vigilance and Awareness: Policyholders must stay vigilant while sharing personal information online and verify the authenticity of insurance websites and communication channels.

Regular Updates and Patches: Advising individuals to keep their devices and software up to date to minimise vulnerabilities that cybercriminals can exploit.

Secure Online Practices: Encouraging the use of strong and unique passwords, avoiding sharing sensitive information on unsecured networks, and exercising caution when clicking on suspicious links or attachments.

Conclusion

As the Indian insurance industry embraces digitisation, the risk of cyber scams and data breaches becomes a significant concern. Insurers and policyholders must collaborate to ensure robust cybersecurity measures are in place to protect sensitive information and financial interests.

It is essential for insurance companies to invest in robust cybersecurity measures that can detect and prevent fraud attempts. Additionally, educating employees on the dangers of cyber fraud and implementing strict compliance measures can go a long way in mitigating risks. With these efforts, the insurance industry can continue to provide trustworthy and reliable services to its customers while protecting against cyber threats. As technology continues to evolve, it is imperative that the insurance industry adapts accordingly and remains vigilant against emerging threats.

Meta slapped by EU fine over data privacy breach

This EU judgment demonstrates how government rules are upending the borderless way data has traditionally migrated.

May 30, 2023

Introduction

The European Union has fined the meta $ 1.3 billion for infringing the EU privacy laws by transferring the personal data of Facebook users to the United States. The EU fined Meta’s business in Ireland. As per the European Union, transferring Personal data to the US is a breach of the General data protection Regulation or European Union law on data protection and privacy.

GDPR Compliance

The terms of GDPR promise to gather users’ personal information legally and under strict conditions. And those who collect and manage personal data must protect users’ personal data from exploitation. The GDPR restricts an organisation’s capacity to transfer personal data outside the EU if the transfer is solely based on that body’s evaluation of the sufficiency of the personal data’s protection. Transfers should only be made where European authorities have determined that a third country, a territory within that third country, or an international organisation provides acceptable protection for data protection.

Violation by Meta

The punishment, announced by Ireland’s Data Protection Commission, might be one of the most significant in the five years since the European Union passed the landmark General Data Protection Regulation. According to regulators, Facebook failed to comply with a 2020 judgment by the European Union’s top court that Facebook data transferred over the Atlantic was not sufficiently safeguarded from American espionage agencies. However, whether Meta will ever need to encrypt Facebook users’ data in Europe is still being determined. Meta announced it would appeal the ruling, launching a potentially legal procedure.

Simultaneously, European Union and American officials are negotiating a new data-sharing pact that would provide legal protections for Meta and scores of other companies to continue moving information between the US and Europe. This pact could overturn much of the European Union’s Monday ruling.

Article 46(1) GDPR Has been violated by the meta, And as per the Irish privacy.

What is required by the GDPR before transferring personal information across national boundaries?

Personal data transfers to countries outside the European Economic Area are generally permitted if these nations are regarded to provide a sufficient degree of data protection. According to Article 45 of the GDPR, the European Commission evaluates the degree of personal data protection in third countries.

The European Union judgment demonstrates how government rules are upending the borderless way data has traditionally migrated. Companies are increasingly being pressed to store data within the country where it is acquired rather than allowing it to transfer freely to data centres around the world as a result of data-protection requirements, national security laws, and other regulations.

The US internet giant had previously warned that if forced to stop using SCCs (standard contractual clauses) without a proper alternative data transfer agreement in place, it would be compelled to shut down services such as Facebook and Instagram in Europe.

What will happen next for Facebook in Europe?

The ruling includes a six-month transition period before it must halt data flows, meaning the service will continue to operate in the meantime. (More specifically, Meta has been given a five-month transition period to freeze any future transfer of personal data to the United States and a six-month deadline to terminate the unlawful processing and/or storage of European user data it has previously transferred without a legitimate legal basis. Meta has also stated that it will appeal and appears to seek a stay of execution while it pursues its legal arguments in court.

Conclusion

The GDPR places restrictions on transferring personal data outside the European Union to third-party nations or international bodies to ensure that the GDPR’s level of protection for individuals is not jeopardised. But the meta violated the European Union’s privacy laws by the user’s personal information to the US. Under the compliance of GDPR, transferring and sending personal information to users intentionally is an offence. and presently, the personal data of Facebook users has been breached by the Meta, as they shared the information with the US.

Space Laws - Indian Perspective

Recent advances in space exploration and technology have increased the need for space laws to control the actions of governments and corporate organisations.

January 24, 2023

Introduction

Recent advances in space exploration and technology have increased the need for space laws to control the actions of governments and corporate organisations. India has been attempting to create a robust legal framework to oversee its space activities because it is a prominent player in the international space business. In this article, we’ll examine India’s current space regulations and compare them to the situation elsewhere in the world.

Space Laws in India

India started space exploration with Aryabhtta, the first satellite, and Rakesh Sharma, the first Indian astronaut, and now has a prominent presence in space as many international satellites are now launched by India. NASA and ISRO work closely on various projects

India currently lacks any space-related legislation. Only a few laws and regulations, such as the Indian Space Research Organisation (ISRO) Act of 1969 and the National Remote Sensing Centre (NRSC) Guidelines of 2011, regulate space-related operations. However, more than these rules and regulations are essential to control India’s expanding space sector. India is starting to gain traction as a prospective player in the global commercial space sector. Authorisation, contracts, dispute resolution, licencing, data processing and distribution related to earth observation services, certification of space technology, insurance, legal difficulties related to launch services, and stamp duty are just a few of the topics that need to be discussed. The necessary statute and laws need to be updated to incorporate space law-related matters into domestic laws.

India’s Space Presence

Space research activities were initiated in India during the early 1960s when satellite applications were in experimental stages, even in the United States. With the live transmission of the Tokyo Olympic Games across the Pacific by the American Satellite ‘Syncom-3’ demonstrating the power of communication satellites, Dr Vikram Sarabhai, the founding father of the Indian space programme, quickly recognised the benefits of space technologies for India.

As a first step, the Department of Atomic Energy formed the INCOSPAR (Indian National Committee for Space Research) under the leadership of Dr Sarabhai and Dr Ramanathan in 1962. The Indian Space Research Organisation (ISRO) was formed on August 15, 1969. The prime objective of ISRO is to develop space technology and its application to various national needs. It is one of the six largest space agencies in the world. The Department of Space (DOS) and the Space Commission were set up in 1972, and ISRO was brought under DOS on June 1, 1972.

Since its inception, the Indian space programme has been orchestrated well. It has three distinct elements: satellites for communication and remote sensing, the space transportation system and application programmes. Two major operational systems have been established – the Indian National Satellite (INSAT) for telecommunication, television broadcasting, and meteorological services and the Indian Remote Sensing Satellite (IRS) for monitoring and managing natural resources and Disaster Management Support.

Global Scenario

The global space race has been on and ever since the moon landing in 1969, and it has now transformed into the new cold war among developed and developing nations. The interests and assets of a nation in space need to be safeguarded by the help of effective and efficient policies and internationally ratified laws. All nations with a presence in space do not believe in good for all policy, thus, preventive measures need to be incorporated into the legal system. A thorough legal framework for space activities is being developed by the United Nations Office for Outer Space Affairs (UNOOSA). The “Outer Space Treaty,” a collection of five international agreements on space law, establishes the foundation of international space law. The agreements address topics such as the peaceful use of space, preventing space from becoming militarised, and who is responsible for damage caused by space objects. Well-established space laws govern both the United States and the United Kingdom. The National Aeronautics and Space Act, which was passed in the US in 1958 and established the National Aeronautics and Space Administration (NASA) to oversee national space programmes, is in place there. The Outer Space Act of 1986 governs how UK citizens and businesses can engage in space activity.

Conclusion

India must create a thorough legal system to govern its space endeavours. In the space sector, there needs to be a legal framework to avoid ambiguity and confusion, which may have detrimental effects. The Pacific use of space for the benefit of humanity should be covered by domestic space legislation in India. The overall scenario demonstrates the requirement for a clearly defined legal framework for the international acknowledgement of a nation’s space activities. India is fifth in the world for space technology, which is an impressive accomplishment, and a strong legal system will help India maintain its place in the space business.

Google Fined Crores by Indian Supreme Court

Why Google's Android practices led to a Rs. 1,337.76 crore penalty in India's Supreme Court. Read on to learn more about the case here.

January 23, 2023

Pretext

On 20th October 2022, the Competition Commission of India (CCI) imposed a penalty of Rs. 1,337.76 crores on Google for abusing its dominant position in multiple markets in the Android Mobile device ecosystem, apart from issuing cease and desist orders. The CCI also directed Google to modify its conduct within a defined timeline. Smart mobile devices need an operating system (OS) to run applications (apps) and programs. Android is one such mobile operating system that Google acquired in 2005. In the instant matter, the CCI examined various practices of Google w.r.t. licensing of this Android mobile operating system and various proprietary mobile applications of Google (e.g., Play Store, Google Search, Google Chrome, YouTube, etc.).

The Issue

Google was found to be misusing its dominant position in the tech market, and the same was the reason behind the penalty. Google argued about the competitive constraints being faced from Apple. In relation to understanding the extent of competition between Google’s Android ecosystem and Apple’s iOS ecosystem, the CCI noted the differences in the two business models, which affect the underlying incentives of business decisions. Apple’s business is primarily based on a vertically integrated smart device ecosystem that focuses on the sale of high-end smart devices with state-of-the-art software components. In contrast, Google’s business was found to be driven by the ultimate intent of increasing users on its platforms so that they interact with its revenue-earning service, i.e., online searches, which directly affects the sale of online advertising services by Google. It was seen that google had created a dominant position among the android phone manufacturers as they were made to have a set of google apps preinstalled in the device to increase the user’s dependency on google services. The CCI felt that Google had created a dominant position to which they replied that the same operations are done by Apple as well, to which the commission responded that apple is a phone and app manufacturer and they have Apple-owned apps in Apple devices only, but Google here in had made a pseudo mandate for android manufactures to have the google apps pre-installed which is, in turn, a possible way of disrupting the market equilibrium and violative of market practices. The CCI imposed a penalty of Rs. 1,337.76 for abusing its dominant position in multiple markets in India, CCI delineated the following five relevant markets in the present matter –

The market for licensable OS for smart mobile devices in India
The market for app store for Android smart mobile OS in India
The market for general web search services in India
The market for non-OS specific mobile web browsers in India
The market for online video hosting platforms (OVHP) in India.

Supreme Courts Opinion

In October 2022, the Competition Commission of India (CCI) ruled that Google, owned by Alphabet Inc, exploited its dominant position in Android and told it to remove restrictions on device makers, including those related to the pre-installation of apps and ensuring exclusivity of its search. Google lost a challenge in the Supreme Court to block the directives, as the learned court refused to put a stay on the imposed penalty, further giving seven days to comply. The Supreme Court has said a lower tribunal—where Google first challenged the Android directives—can continue to hear the company’s appeal and must rule by March 31.

Counterpoint Research estimates that about 97% of 600 million smartphones in India run on Android. Apple has just a 3% share. Hoping to block the implementation of the CCI directives, Google challenged the CCI order in the Supreme Court by warning it could stall the growth of the Android ecosystem. It also said it would be forced to alter arrangements with more than 1,100 device manufacturers and thousands of app developers if the directives kick in. Google has been concerned about India’s decision as the steps are seen as more sweeping than those imposed in the European Commission’s 2018 ruling. There it was fined for putting in place what the Commission called unlawful restrictions on Android mobile device makers. Google is still challenging the record $4.3 billion fine in that case. In Europe, Google made changes later, including letting Android device users pick their default search engine, and said device makers would be able to license the Google mobile application suite separately from the Google Search App or the Chrome browser.

‍

Conclusion

As the world goes deeper into cyberspace, the big tech companies have more control over the industry and the markets, but the same should not turn into anarchy in the global markets. The Tech giants need to be made aware that compliance is the utmost duty for all companies, and enforcement of the law of the land will be maintained no matter what. Earlier India lacked policies and legislation to govern cyberspace, but in the recent proactive stance by the govt, a lot of new bills have been tabled, one of them being the Intermediary Rules 2021, which has laid down the obligations nand duties of the companies by setting up an intermediary in the country. Such bills coupled with such crucial judgments on tech giants will act as a test and barrier for other tech companies who try to flaunt the rules and avoid compliance.

What are Wi-Fi Attacks | Ethical Hacking

Learn about Wi-Fi attacks and how to protect your network from hackers. Discover the risks of unsecured Wi-Fi and the advantages of Li-Fi technology.

December 8, 2022

What are Wi-Fi attacks?

Wi-fi is an important area of cyber security and there is no need for physical cable for the network. Wi-Fi has access to a network signal radius everywhere. The devices and systems can have a network without physical access due to Wi-fi. But everything comes with cons and pros, and if we talk about cybersecurity, it has been established that Wi-fi networks are extremely vulnerable to security breaches and it is very easy to be hacked by hackers. Wi-Fi can be accessed by almost every device in the modern day: it can be smartphones, tablets, computers, and laptops. To know whether someone has been tampering with your personal Wi-Fi there are certain signs that can prove it. The first and most important sign is that your internet speed gets slower, as someone else is using your Wi-Fi surf.

Why would anyone hack someone’s Wi-Fi network?

Usually, hackers hack the network because they want access to the confidential data of someone and they can observe all the online activities and data that have been sent through a network. An unauthorize hacker will pretty much be able to see everything you do online. Wi-Fi allows hackers o view information on sites. Any financial information which is saved in the browser can be accessed by hackers and they can alter it and can alter the content you see online. And all the information saved in Wi-fi networks can be used by hackers for their own benefit, they can sell it, impersonate you, or even take money out of your bank through Wi-Fi.

Avoiding vulnerable Wi-Fi networks

The first and foremost rule of protection is that you should not use public networks if that network is easily open to you then that is also available to others and from others, and someone can who wishes to use your confidential and sensitive information, can access that. If you really need to access the public network in an urgent situation, then you must make sure to limit your activities while connected. And avoid accessing your online banking or pages that require login information. Also, a good measure to take as well is to always delete your cookies after using public WIFI.

How To Secure Your Home Wi-Fi Network

Your home’s wireless internet connection is your Wi-Fi network. Typically, a wireless router is used, which broadcasts a signal into the atmosphere. You can connect to the internet using that signal. However, if your network is not password-protected, any nearby device can grab the signal off the air and connect to your internet. The benefit of Wi-Fi? Wireless access to the internet is possible. The negative? Your internet activity, including your personal information, may be visible to neighboring users who connect to your unprotected network. Furthermore, if someone uses your network to conduct a crime or send out unauthorized spam, you might be held accountable.

Wi-Fi or Li-Fi? –

The common consensus is that Li-Fi technology is more secure than Wi-Fi. Li-Fi systems can be made more secure by integrating a variety of security features. Although these qualities might appear when Li-Fi is widely used in the near future, it is already thought to be safer because of a number of security features. Since the connection’s characteristics make it simpler to lock connections, limit access, and track users even in the absence of encryption and other security features, Li-Fi is seen as being safer. Li-Fi systems will be able to support new security protocols, which will not only enable high-speed networking but also open the door for innovative security techniques to strengthen connections.

Conclusion

A hacker can sniff the network packets without having to be in the same building where the network is located. As wireless networks communicate through radio waves, a hacker can easily sniff the network from a nearby location. Most attackers use network sniffing to find the SSID and hack a wireless network.

Any wireless network can theoretically be attacked in a number of different ways. Use of the default SSID or password, WPS pin authentication, insufficient access control, and leaving the access point available in open locations are all examples of potential vulnerabilities that could allow for the theft of sensitive data. Kismet’s architecture in WIDS mode may guard against DOS, MiTM, and MAC spoofing attacks. routine software updates on the other hand, the use of firewalls may help defend the network against outside intrusion. The act of finding infrastructure issues that could allow harmful code to be injected into a service, system, or organization is known as ethical hacking. They use this technique to prevent invasions by lawfully breaking into networks and looking for weak spots.

Google Play Enhancing Trust and Transparency

Google Play introduces a new policy for developer verification with D-U-N-S numbers and enhanced app details to build user trust and transparency.

July 28, 2023

Introduction

Google Play has announced its new policy which will ensure trust and transparency on google play by providing a new framework for developer verification and app details. The new policy requires that new developer accounts on Google Play will have to provide a D-U-N-S number to verify the business. So when an organisation will create a new Play Console developer account the organisation will need to provide a D-U-N-S number. Which is a nine-digit unique identifier which will be used to verify their business. The new google play policy aims to enhance user trust. And the developer will provide detailed developer details on the app’s listing page. Users will get to know who is behind the app which they are installing.

Verifying Developer Identity with D-U-N-S Numbers

To boost security the google play new policy requires the developer account to provide the D-U-N-S number when creating a new Play Console developer account. The D-U-N-S number assigned by Dun & Bradstreet will be used to verify the business. Once the developer creates his new Play Console developer account by providing a D-U-N-S number, Google Play will verify the developer’s details, and he will be able to start publishing the apps. Through this step, Google Play aims to validate the business information in a more authentic way.

If your organisation does not have a D-U-N-S number, you may check on or request for it for free on this website (https://www.dnb.com/duns-number/lookup.html). The request process for D-U-N-S can take up to 30 days. Developers are also required to keep the information up to date.

‍Building User Trust with Enhanced App Details

In addition to verifying developer identities in a more efficient way, google play also requires that developer provides sufficient app details to the users. There will be an “App Support” section on the app’s store listing page, where the developer will display the app’s support email address and even can include their website and phone number for support.

The new section “About the developer” will also be introduced to provide users with verified identity information, including the developer’s name, address, and contact details. Which will make the users more informed about the valuable information of the app developers.

Key highlights of the Google Play Polic

Google Play came up with the policy to keep the platform safe by verifying the developers’ identity and it will also help to reduce the spread of malware apps and help the users to make confident informed decisions about the apps they download. Google Play announced the policy by expanding its developer verification requirement to strengthen Google Play as a platform and build user trust. When you create a new Play Console Developer account and choose organisation as your account type you will now need to provide a D-U-N-S number.
Users will get detailed information about the developers’ identities and contact information, building more transparency and encouraging responsible app development practices.
This policy will enable the users to make informed choices about the apps they download.
The new “App support” section will provide enhanced communication between users and developers by displaying support email addresses, website and support phone numbers, streamlining the support process and user satisfaction.

Timeline and Implementation

The new policy requirements for D-U-N-S numbers will start rolling out on 31 August 2023 for all new Play Console developer accounts. The “About the developer” section will be visible to users as soon as a new app is published. and In October 2023, existing developers will also be required to update and verify their existing accounts to comply with the new verification policy.

Conclusion

Google Play’s new policy will aim to enhance the more transparent app ecosystem. This new policy will provide the users with more information about the developers. Google Play aims to establish a platform where users can confidently discover and download apps. This new policy will enhance the user experience on google play in terms of a reliable and trustworthy platform.

TRAI’s Consultation Paper on OTT Platforms

Explore the Telecom Regulatory Authority of India's Consultation Paper on Regulatory Mechanisms for Over-The-Top (OTT) Communication Services.

July 9, 2023

Introduction

Recently, a Consultation Paper on Regulatory Mechanisms for Over-The-Top (OTT) Communication Services was published by the Telecom Regulatory Authority of India (TRAI). The paper explores several OTT regulation-related challenges and solicits input from stakeholders on a suggested regulatory framework. We’ll summarise the paper’s main conclusions in this blog.

Structure of the Paper

The Telecom Regulatory Authority of India’s Consultation Paper on Regulatory Mechanism for Over-The-Top (OTT) Communication Services and Selective Banning of OTT Services intends to solicit comments and recommendations from stakeholders about the regulation of OTT services in India. The paper is broken up into five chapters that cover the introduction and background, issues with regulatory mechanisms for OTT communication services, issues with the selective banning of OTT services, a summary of the issues for consultation, and an overview of international practices on the topic. Written comments from interested parties are requested and may be sent electronically to the Advisor (Networks, Spectrum and Licencing) at TRAI. These comments will also be posted on the TRAI website.

Overview of the Paper

Chapter 1: Introduction and Background

The first chapter of the essay introduces the subject of OTT communication services and argues why regulatory frameworks are necessary. The chapter also gives a general outline of the topics and the paper’s organisation that will be covered in the following chapters.

Chapter 2: Examination of the Issues Related to Regulatory Mechanism for Over-The-Top Communication Services

The second chapter of the essay looks at the problems with OTT communication service regulation. It talks about the many kinds of OTT services and how they affect the conventional telecom sector. The chapter also looks at the regulatory issues raised by OTT services and the various strategies used by various nations to address them.

Chapter 3: Examination of the Issues Related to Selective Banning of OTT Services

The final chapter of the essay looks at the problems of selectively outlawing OTT services. It analyses the justifications for government restrictions on OTT services as well as the possible effects of such restrictions on consumers and the telecom sector. The chapter also looks at the legal and regulatory structures that determine how OTT services are prohibited in various nations.

Chapter 4: International Practices

An overview of global OTT communication service best practices is given in the paper’s fourth chapter. It talks about the various regulatory strategies used by nations throughout the world and how they affect consumers and the telecom sector. The chapter also looks at the difficulties regulators encounter when trying to create efficient regulatory frameworks for OTT services.

Chapter 5: Issues for Consultation

This chapter is the spirit of the consultation paper as it covers the points and questions for consultation. This chapter has been classified into two sub-sections – Issues Related to Regulatory Mechanisms for OTT Communication Services and Issues Related to the Selective Banning of OTT Services. The inputs will be entirely focused on these sub headers, and the scope, extent, and ambit of the consultation paper rests on these questions and necessary inputs.

Conclusion

An important publication that aims to address the regulatory issues raised by OTT services is the Consultation Paper on Regulatory Mechanisms for Over-The-Top Communication Services. The paper offers a thorough analysis of the problems with OTT service regulation and requests input from stakeholders on the suggested regulatory structure. In order to make sure that the regulatory framework is efficient and advantageous for everyone, it is crucial for all stakeholders to offer their opinion on the document.

Twitter on Legal CrossRoads

Twitter's appeal against the Ministry of Electronics and Information Technology's account-blocking orders has been denied by the Karnataka High Court.

July 3, 2023

Introduction

Twitter Inc.’s appeal against barring orders for specific accounts issued by the Ministry of Electronics and Information Technology was denied by a single judge on the Karnataka High Court. Twitter Inc. was also given an Rs. 50 lakh fine by Justice Krishna Dixit, who claimed the social media corporation had approached the court defying government directives.

As a foreign corporation, Twitter’s locus standi had been called into doubt by the government, which said they were ineligible to apply Articles 19 and 21 to their situation. Additionally, the government claimed that because Twitter was only designed to serve as an intermediary, there was no “jural relationship” between Twitter and its users.

The Issue

In accordance with Section 69A of the Information Technology Act, the Ministry issued the directives. Nevertheless, Twitter had argued in its appeal that the orders “fall foul of Section 69A both substantially and procedurally.” Twitter argued that in accordance with 69A, account holders were to be notified before having their tweets and accounts deleted. However, the Ministry failed to provide these account holders with any notices.

On June 4, 2022, and again on June 6, 2022, the government sent letters to Twitter’s compliance officer requesting that they come before them and provide an explanation for why the Blocking Orders were not followed and why no action should be taken against them.

Twitter replied on June 9 that the content against which it had not followed the blocking orders does not seem to be a violation of Section 69A. On June 27, 2022, the Government issued another notice stating Twitter was violating its directions. On June 29, Twitter replied, asking the Government to reconsider the direction on the basis of the doctrine of proportionality. On June 30, 2022, the Government withdrew blocking orders on ten account-level URLs but gave an additional list of 27 URLs to be blocked. On July 10, more accounts were blocked. Compiling the orders “under protest,” Twitter approached the HC with the petition challenging the orders.

Legality

Additionally, the government claimed that because Twitter was only designed to serve as an intermediary, there was no “jural relationship” between Twitter and its users.

Government attorney Additional Solicitor General R Sankaranarayanan argued that tweets mentioning “Indian Occupied Kashmir” and the survival of LTTE commander Velupillai Prabhakaran were serious enough to undermine the integrity of the nation.

Twitter, on the other hand, claimed that its users have pushed for these rights. Additionally, Twitter maintained that under Article 14 of the Constitution, even as a foreign company, they were entitled to certain rights, such as the right to equality. They also argued that the reason for the account blocking in each case was not stated and that Section 69a’s provision for blocking a URL should only apply to the offending URL rather than the entire account because blocking the entire account would prevent the creation of information while blocking the offending tweet only applied to already-created information.

Conclusion

The evolution of cyberspace has been substantiated by big tech companies like Facebook, Google, Twitter, Amazon and many more. These companies have been instrumental in leading the spectrum of emerging technologies and creating a blanket of ease and accessibility for users. Compliance with laws and policies is of utmost priority for the government, and the new bills and policies are empowering the Indian cyberspace. Non Compliance will be taken very seriously, and the same is legalised under the Intermediary Guidelines 2021 and 2022 by Meity. Referring to Section 79 of the Information Technology Act, which pertains to an exemption from liability of intermediary in some instances, it was said, “Intermediary is bound to obey the orders which the designate authority/agency which the government fixes from time to time.”

Guidelines on Information Security Practices

Learn about common online security risks and get tips to enhance your online security in this informative guide.

July 3, 2023

Introduction

Cert-In (Indian Computer Emergency Response Team) has recently issued the “Guidelines on Information Security Practices” for Government Entities for Safe & Trusted Internet. The guideline has come at a critical time when the Draft Digital India Bill is about to be released, which is aimed at revamping the legal aspects of Indian cyberspace. These guidelines lay down the policy framework and the requirements for critical infrastructure for all government organisations and institutions to improve the overall cyber security of the nation.

What is Cert-In?

A Computer Emergency Response Team (CERT) is a group of information security experts responsible for the protection against, detection of and response to an organisation’s cybersecurity incidents. A CERT may focus on resolving data breaches and denial-of-service attacks and providing alerts and incident handling guidelines. CERTs also conduct ongoing public awareness campaigns and engage in research aimed at improving security systems. The Ministry of Electronics and Information Technology (MeitY) oversees CERT-In. It regularly releases alerts to help individuals and companies safeguard their data, information, and ICT (Information and Communications Technology) infrastructure.

Indian Computer Emergency Response Team (CERT-In) has been established and appointed as national agency in respect of cyber incidents and cyber security incidents in terms of the provisions of section 70B of Information Technology (IT) Act, 2000.

CERT-In requests information from service providers, intermediaries, data centres, and body corporates to coordinate reaction actions and emergency procedures regarding cyber security incidents. It is a focal point for incident reporting and offers round-the-clock security services. It manages cyber occurrences that are tracked and reported while continuously analysing cyber risks. It strengthens the security barriers for the Indian Internet domain.

Background

India is fast becoming one of the world’s largest connected nations – with over 80 Crore Indians (Digital Nagriks) presently connected and using the Internet and cyberspace – and with this number is expected to touch 120 Crores in the coming few years. The Digital Nagriks of the country are using the Internet for business, education, finance and various applications and services including Digital Government services. Internet provides growth and innovation and at the same time it has seen rise in cybercrimes, user harm and other challenges to online safety. The policies of the Government are aimed at ensuring an Open, Safe & Trusted and Accountable Internet for its users. Government is fully cognizant and aware of the growing cyber security threats and attacks.

It is the Government of India’s objective to ensure that Digital Nagriks experience a Safe & Trusted Internet. Along with ubiquitous applications of Information & Communication Technologies (ICT) in almost all facets of service delivery and operations, continuously evolving cyber threats have become a concern for the Government. Cyber-attacks can come in the form of malware, ransomware, phishing, data breach etc., that adversely affect an organisation’s information and systems. Cyber threats leading to cyber-attacks or incidents can compromise the confidentiality, integrity, and availability of an organisation’s information and systems and can have far reaching impact on essential services and national interests. To protect against cyber threats, it is important for government entities to implement strong cybersecurity measures and follow best practices. As ICT infrastructure of the Government entities is one of the preferred targets of the malicious actors, responsibility of implementing good cyber security practices for protecting computers, servers, applications, electronic systems, networks, and data from digital attacks, also remain with the ICT assets’ owner i.e. Government entity.

What are the new Guidelines about?

The Government of India (distribution of business) Rules, 1961’s First Schedule lists a number of Ministries, Departments, Secretariats, and Offices, along with their affiliated and subordinate offices, which are all subject to the rules. They also comprise all governmental organisations, businesses operating in the public sector, and other governmental entities under their administrative control.

“The government has launched a number of steps to guarantee an accessible, trustworthy, and accountable digital environment. With a focus on capabilities, systems, human resources, and awareness, we are extending and speeding our work in the area of cyber security, according to Rajeev Chandrasekhar, Minister of State for Electronics, Information Technology, Skill Development, and Entrepreneurship.

The Recommendations

Various security domains are covered in the standards, including network security, identity and access management, application security, data security, third-party outsourcing, hardening procedures, security monitoring, incident management, and security audits.
For instance, the rules advise using only a Standard User (non-administrator) account to use computers and laptops for regular work regarding desktop, laptop, and printer security in the workplace. Users may only be granted administrative access with the CISO’s consent.
The usage of lengthy passwords containing at least eight characters that combine capital letters, tiny letters, numerals, and special characters; Never save any usernames or passwords in your web browser. Likewise, never save any payment-related data there.
They include guidelines created by the National Informatics Centre for Chief Information Security Officers (CISOs) and staff members of Central government Ministries/Departments to improve cyber security and cyber hygiene in addition to adhering to industry best practises.

Conclusion

The government has been proactive in the contemporary times to eradicate the menace of cybercrimes and therreats from the Indian cyberspace and hence now we have seen a series of new bills and polices introduced by the Ministry of Electronics and Information Technology, and various other government organisations like Cert-In and TRAI. These policies have been aimed towards being relevant to time and current technologies. The threats from emerging technologies like web 3.0 cannot be ignored and hence with active netizen participation and synergy between government and corporates will lead to a better and improved cyber ecosystem in India.

TRAI’s Consultation Paper

Discover the future of digital communication with TRAI's groundbreaking sandbox proposal.

July 1, 2023

Introduction

The Telecom Regulatory Authority of India (TRAI) issued a consultation paper titled “Encouraging Innovative Technologies, Services, Use Cases, and Business Models through Regulatory Sandbox in Digital Communication Sector. The paper presents a draft sandbox structure for live testing of new digital communication products or services in a regulated environment. TRAI seeks comments from stakeholders on several parts of the framework.

What is digital communication?

Digital communication is the use of internet tools such as email, social media messaging, and texting to communicate with other people or a specific audience. Even something as easy as viewing the content on this webpage qualifies as digital communication.

Aim of Paper

Frameworks are intended to support regulators’ desire for innovation while also ensuring economic resilience and consumer protection. Considering this, the Department of Telecom (DoT) asked TRAI to offer recommendations on a regulatory sandbox framework. TRAI approaches the issue with the goal of encouraging creativity and hastening the adoption of cutting-edge digital communications technologies.
Artificial intelligence, the Internet of Things, edge computing, and other emerging technologies are revolutionizing how we connect, communicate, and access information, driving the digital communication sector to rapidly expand. To keep up with this dynamic environment, an enabling environment for the development and deployment of novel technologies, services, use cases, and business models is required.
The regulatory sandbox concept is becoming increasingly popular around the world as a means of encouraging innovation in a range of industries. A regulatory sandbox is a regulated environment in which businesses and innovators can test their concepts, commodities, and services while operating under changing restrictions.
Regulatory Sandbox will benefit the telecom startup ecosystem by providing access to a real-time network environment and other data, allowing them to evaluate the reliability of new applications before releasing them to the market. Regulatory Sandbox also attempts to stimulate cross-sectoral collaboration for carrying out such testing by engaging the assistance of other ministries and departments in order to give the starting company with a single window for acquiring all clearances.

What is regulatory sandbox?

A regulatory sandbox is a controlled regulatory environment in which new products or services are tested in real-time.
It serves as a “safe space” for businesses because authorities may or may not allow certain relaxations for the sole purpose of testing.
The sandbox enables the regulator, innovators, financial service providers, and clients to perform field testing in order to gather evidence on the benefits and hazards of new financial innovations, while closely monitoring and mitigating their risks.

What are the advantages of having a regulatory sandbox?

Firstly, regulators obtain first-hand empirical evidence on the benefits and risks of emerging technologies and their implications, allowing them to form an informed opinion on the regulatory changes or new regulations that may be required to support useful innovation while mitigating the associated risks.
Second, sandbox customers can evaluate the viability of a product without the need for a wider and more expensive roll-out. If the product appears to have a high chance of success, it may be authorized and delivered to a wider market more quickly.

Digital communication sector and Regulatory Sandbox

Many countries’ regulatory organizations have built sandbox settings for telecom tech innovation.
These frameworks are intended to encourage regulators’ desire for innovation while also promoting economic resilience and consumer protection.
In this context, the Department of Telecom (DoT) had asked TRAI to give recommendations on a regulatory sandbox framework.
Written comments on the drafting framework will be received until July 17, 2023, and counter-comments will be taken until August 1, 2023. The Authority’s goal in the digital communication industry is to foster creativity and expedite the use of emerging technologies such as artificial intelligence (AI), the Internet of Things (IoT), and edge computing. These technologies are changing the way individuals connect, engage, and access information, causing rapid changes in the industry.

Conclusion

According to TRAI, these technologies are changing how individuals connect, engage, and obtain information, resulting in significant changes in the sector.

The regulatory sandbox also wants to stimulate cross-sectoral collaboration for carrying out such testing by engaging the assistance of other ministries and departments in order to give the starting company with a single window for acquiring all clearances. The consultation paper covers some of the worldwide regulatory sandbox frameworks in use in the digital communication industry, as well as some of the frameworks in use inside the country in other sectors.

TRAI’s New Directions

TRAI has taken several initiatives to reduce Unsolicited Commercial Communication (UCC), which is a major source of annoyance for the public.

June 20, 2023

Introduction

The Telecom Regulatory Authority of India (TRAI) has directed all telcos to set up detection systems based on Artificial Intelligence and Machine Learning (AI/ML) technologies in order to identify and control spam calls and text messages from unregistered telemarketers (UTMs).

The TRAI Directed telcos

The telecom regulator, TRAI, has directed all Access Providers to detect Unsolicited commercial communication (UCC)by systems, which is based on Artificial Intelligence and Machine Learning to detect, identify, and act against senders of Commercial Communication who are not registered in accordance with the provisions of the Telecom Commercial Communication Customer Preference Regulations, 2018 (TCCCPR-2018). Unregistered Telemarketers (UTMs) are entities that do not register with Access Providers and use 10-digit mobile numbers to send commercial communications via SMS or calls.

TRAI steps to curb Unsolicited commercial communication

TRAI has taken several initiatives to reduce Unsolicited Commercial Communication (UCC), which is a major source of annoyance for the public. It has resulted in fewer complaints filed against Registered Telemarketers (RTMs). Despite the TSPs’ efforts, UCC from Unregistered Telemarketers (UTMs) continues. Sometimes, these UTMs use messages with bogus URLs and phone numbers to trick clients into revealing crucial information, leading to financial loss.

To detect, identify, and prosecute all Unregistered Telemarketers (UTMs), the TRAI has mandated that Access Service Providers implement the UCC.

Detect the System with the necessary functionalities within the TRAI’s Telecom Commercial Communication Customer Preference Regulations, 2018 framework.

Access service providers have implemented such detection systems based on their applicability and practicality. However, because UTMs are constantly creating new strategies for sending unwanted communications, the present UCC detection systems provided by Access Service providers cannot detect such UCC.

TRAI also Directs Telecom Providers to Set Up Digital Platform for Customer Consent to Curb Promotional Calls and Messages.

Unregistered Telemarketers (UTMs) sometimes use messages with fake URLs and phone numbers to trick customers into revealing essential information, resulting in financial loss.

TRAI has urged businesses like banks, insurance companies, financial institutions, and others to re-verify their SMS content templates with telcos within two weeks. It also directed telecom companies to stop misusing commercial messaging templates within the next 45 days.

The telecom regulator has also instructed operators to limit the number of variables in a content template to three. However, if any business intends to utilise more than three variables in a content template for communicating with their users, this should be permitted only after examining the example message, as well as adequate justifications and justification.

In order to ensure consistency in UCC Detect System implementations, TRAI has directed all Access Providers to deploy UCC and detect systems based on artificial intelligence and Machine Learning that are capable of constantly evolving to deal with new signatures, patterns, and techniques used by UTMs.

Access Providers have also been directed to use the DLT platform to share intelligence with others. Access Providers have also been asked to ensure that such UCC Detect System detects senders that send unsolicited commercial communications in bulk and do not comply with the requirements. All Access Providers are directed to follow the instructions and provide an update on actions done within thirty days.

The move by TRAI is to curb the menacing calls as due to this, the number of scam cases is increasing, and now a new trend of scams started as recently, a Twitter user reported receiving an automated call from +91 96681 9555 with the message “This call is from Delhi Police.” It then asked her to stay in the queue since some of her documents needed to be picked up. Then he said he works as a sub-inspector at the Kirti Nagar police station in New Delhi. He then inquired whether she had recently misplaced her Aadhaar card, PAN card, or ATM card, to which she replied ‘no’. The scammer then poses as a cop and requests that she authenticate the last four digits of her card because they have found a card with her name on it. And a lot of other people tweeted about it.

Conclusion

TRAI directed the telcos to check the calls and messages from Unregistered numbers. This step of TRAI will curb the pesky calls and messages and catch the Frauds who are not registered with the regulation. Sometimes the unregistered sender sends fraudulent links, and through these fraudulent calls and messages, the sender tries to take the personal information of the customers, which results in financial losses.

TRAIs crackdown on pesky calls and messages

It stated that only approved online or app links, call-back numbers, and so on will be permitted to be used in consent-seeking communications.

June 17, 2023

Introduction

To combat the problem of annoying calls and SMS, telecom regulator TRAI has urged service providers to create a uniform digital platform in two months that will allow them to request, maintain, and withdraw customers’ approval for promotional calls and messages. In the initial stage, only subscribers will be able to initiate the process of registering their consent to receive promotional calls and SMS, and later, business entities will be able to contact customers to seek their consent to receive promotional messages, according to a statement issued by the Telecom Regulatory Authority of India (TRAI) on Saturday.

TRAI Directs Telecom Providers to Set Up Digital Platform

TRAI has now directed all access providers to develop and deploy the Digital Consent Acquisition (DCA) facility for creating a unified platform and process to digitally register customers’ consent across all service providers and principal entities. Consent is received and maintained under the current system by several key entities such as banks, other financial institutions, insurance firms, trading companies, business entities, real estate businesses, and so on.

The purpose, scope of consent, and the principal entity or brand name shall be clearly mentioned in the consent-seeking message sent over the short code,” according to the statement.

It stated that only approved online or app links, call-back numbers, and so on will be permitted to be used in consent-seeking communications.

TRAI issued guidelines to guarantee that all voice-based Telemarketers are brought under a single Distributed ledger technology (DLT) platform for more efficient monitoring of nuisance calls and unwanted communications. It also instructs operators to actively deploy AI/ML-based anti-phishing systems as well as to integrate tech solutions on the DLT platform to deal with malicious calls and texts.

TRAI has issued two separate Directions to Access Service Providers under TCCCPR-2018 (Telecom Commercial Communications Customer Preference Regulations) to ensure that all promotional messages are sent through Registered Telemarketers (RTMs) using approved Headers and Message Templates on Distributed Ledger Technologies (DLT) platform, and to stop misuse of Headers and Message Templates,” the regulator said in a statement.

Users can already block telemarketing calls and texts by texting 1909 from their registered mobile number. By dialing 1909, customers can opt out of getting advertising calls by activating the do not disturb (DND) feature.

Telecom providers operate DLT platforms, and businesses involved in sending bulk promotional or transactional SMS must register by providing their company information, including sender IDs and SMS templates.

According to the instructions, telecom companies will send consent-seeking messages using the common short code 127. The goal, extent of consent, and primary entity/brand name must be clearly stated in the consent-seeking message delivered via the shortcode.

TRAI stated that only whitelisted URLs/APKs (Android package kits file format)/OTT links/call back numbers, etc., shall be used in consent-seeking messages.

Telcos must “ensure that promotional messages are not transmitted by unregistered telemarketers or telemarketers using telephone numbers (10 digits numbers).” Telecom providers have been urged to act against all erring telemarketers in accordance with the applicable regulations and legal requirements.

Users can, however, refuse to receive any consent-seeking messages launched by any significant Telcos have been urged to create an SMS/IVR (interactive voice response)/online service for this purpose.

According to TRAI’s timeline, the consent-taking process by primary companies will begin on September 1.According to a nationwide survey conducted by a local circle, 66% of mobile users continue to receive three or more bothersome calls per day, the majority of which originate from personal cell numbers.

There are scams surfacing on the internet with new types of scams, like WhatsApp international call scams. The latest scam is targeting Delhi police, the scammers pretend to be police officials of Delhi and ask for the personal details of the users and the calling them from a 9-digit number.

A recent scam

A Twitter user reported receiving an automated call from +91 96681 9555, stating, “This call is from Delhi Police.” It went on to ask her to stay in the queue since some of her documents needed to be picked up. Then he said he is a sub-inspector at New Delhi’s Kirti Nagar police station. He then questioned if she had lately misplaced her Aadhaar card, PAN card, or ATM card, to which she replied ‘no’. The fraudster then claims to be a cop and asks her to validate the final four digits of her card because they have discovered a card with her name on it. And so many other people tweeted about this.

The scams are constantly increasing as earlier these scammers asked for account details and claimed to be Delhi police and used 9-digit numbers for scamming people.

TRAI’s new guidelines regarding the consent to receive any promotional calls and messages to telecommunication providers will be able to curb the scams.

The e- KYC is an essential requirement as e-KYC offers a more secure identity verification process in an increasingly digital age that uses biometric technologies to provide quick results.

Conclusion

The aim is to prevent unwanted calls and communications sent to customers via digital methods without their permission. Once this platform is implemented, an organization can only send promotional calls or messages with the customer’s explicit approval. Companies use a variety of methods to notify clients about their products, including phone calls, text messages, emails, and social media. Customers, however, are constantly assaulted with the same calls and messages as a result of this practice. With the constant increase in scams, the new guideline of TRAI will also curb the calling of Scams. digital KYC prevents SIM fraud and offers a more secure identity verification method.

New Regulations for Online Gaming

Recently some games faced a ban in India – games that involve betting, games that can be harmful to the user, and games that involve a factor of addiction.

June 17, 2023

Introduction

Online Gaming has gained popularity over the past few years, attracting young players worldwide and global concerns. In response to the growing fame of this industry, the Indian government has recently announced introducing a set of regulations to address various concerns and ensure a safer and more regulated online gaming environment. In this blog post, we will explore the critical aspects of these regulations and their impact on the gaming industry.

Why are Regulations needed?

Recently some games faced a ban in India – games that involve betting, games that can be harmful to the user, and games that involve a factor of addiction. Furthermore, with rising popularity, With the exponential rise of online gaming platforms in India, extensive laws to safeguard players and ensure fair gameplay needs to be implemented. Players’ protection is one of the critical factors addressing the issues which involve online addiction, underage involvement, fraud, and data privacy has become critical for the well-being of Indian gamers.

Regulatory Ambiguity: The previous legislative structure, such as the outmoded Public Gambling Act of 1867, required an update to fit the digital gambling age fully.

Outline of the New Regulations

Implementing new regulations for online gaming in India represents the government’s commitment to addressing different issues and ensuring a safer and more regulated gaming sector. Let’s have a look at these rules in detail:

National-Level Standards: The Indian government is currently working on creating national-level standards to standardise online gaming practices across all states. These rules attempt to create a uniform platform for both operators and participants. The government has also made an announcement to set SRO within 90 days to regulate online gaming.

Licencing and Compliance: To legally operate in the Indian market, online gaming firms must secure licences. The operator’s financial soundness, security measures, and adherence to responsible gaming practices will be scrutinised throughout the licencing process. Operators will need to comply with the regulations in order to maintain operations.

Measures to Promote Ethical Gaming: The new regulations emphasise player protection and ethical gaming practices. This includes steps like age verification to prevent underage involvement, self-exclusion choices for gamers who want to limit their gaming activities, and adopting tools like session limits and reality checks to promote responsible gaming.

Data Privacy: Recognising the importance of data privacy, the laws are intended to contain protections for protecting user data. To safeguard sensitive player information from unauthorised access or exploitation, online gambling operators must comply with data protection regulations and deploy strong security measures.

Restrictions on Advertising and Marketing: The legislation may limit the advertising and marketing of online gaming platforms. The emphasis will be on eliminating aggressive marketing tactics that target vulnerable people, such as kids. Stricter standards for ad content and placement may be implemented.

Anti-Fraud and Anti-Money Laundering Measures: To combat criminal activity within the gaming ecosystem, the new legislation will almost certainly force online gambling companies to employ anti-fraud and anti-money laundering measures. Operators may need to set up mechanisms to detect fraud, report suspicious activity, and work with law enforcement.

Consumer Grievance Redressal: The legislation may emphasise the construction of efficient channels for resolving consumer complaints. Players should be able to report difficulties, seek resolution, and offer feedback on their play experiences through channels. The objective is to create a transparent and accountable conflict resolution mechanism.

Impact on Online Gaming Ecosystem

Adopting new laws for online gambling in India will likely have several consequences for the gaming industry. Let us look at some of these consequences:

Increased Player Trust: Implementing restrictions will increase player confidence in online gaming platforms. Establishing clear rules and procedures and steps to safeguard participants’ interests will develop a sense of trust and transparency. This can lead to increased participation and engagement in the gaming community.

Industry Consolidation: Stricter restrictions may result in industry consolidation. Compliance with the new legislation would need resources and investments, which might favour more prominent and more established gambling firms. Smaller and more non-compliant operators may find it challenging to fulfil regulatory standards, resulting in a more consolidated gaming sector.

Technological Progress: The requirement to comply with rules could lead to technological advancements in the online gambling sector. Operators may invest in modern identity verification systems, fraud detection methods, and responsible gaming solutions to satisfy their regulatory requirements. This can result in technological breakthroughs that improve gamers’ overall gaming experience.

Foreign Investment and Collaboration: Clear laws might entice overseas investors to enter the Indian gaming business. The regulated environment may appeal to international gambling enterprises looking to enter or extend their presence in India. Collaborations between Indian and foreign gaming firms may also expand, resulting in the sharing of experience, resources, and the production of high-quality gaming products.

Legal Clarity: Implementing particular laws would give online gambling operators and users clearer legal standards. This transparency can eliminate ambiguity and possible legal issues, allowing stakeholders to navigate the gaming ecosystem with better confidence and knowledge.

Contribution to the Indian Economy: A well-regulated online gaming business has the potential to contribute to the Indian economy. It has the potential to create jobs, attract investment, and produce tax money for the government. The economic effect of the gaming ecosystem is expected to increase as it grows under the new restrictions.

Challenges and Future Approach

One of the toughest challenges will be the efficient implementation and enforcement of the new regulations. Consistency in applying the legislation across multiple jurisdictions and guaranteeing compliance by all operators would necessitate comprehensive monitoring and regulatory measures. Developing suitable enforcement organisations and transparent standards for reporting and dealing with noncompliance will be critical. Besides this, online gaming is open to more than area-specific and many gaming platforms and operates internationally. Ensuring cross-border operations is a big challenge in addressing jurisdictional challenges will be complex. Collaborative efforts between nations can regulate cross-border online gaming. There may be increased collaboration between Indian and foreign gaming firms, resulting in the exchange of information, skills, and resources. This partnership can help the Indian gaming sector flourish while attracting foreign players and investments.

Esports Development: Esports have grown in popularity worldwide, and India is no exception. The Indian esports business has the potential to thrive with proper regulation and support, drawing both players and viewers. Esports-specific factors like player contracts, tournament integrity, and licencing requirements may be addressed in the regulations.

Conclusion

Despite obstacles, India’s new online gambling legislation can potentially establish a safer and more regulated gaming sector. the future depends on successful implementation, adjusting to a shifting landscape, finding the correct balance between regulation and innovation, and promoting ethical gaming practices. The Indian online gaming business can develop sustainably with the appropriate strategy, benefiting gamers and the broader economy.

Government to certify ‘Permissible Online Games’: What you need to know

Ministry of Electronics and Information Technology (MeitY) Announces to Centre Government to Plan to Certify Permissible Online Games.

June 7, 2023

Introduction

Ministry of Electronics and Information Technology (MeitY) Announces to Centre Government to Plan to Certify Permissible Online Games.

In a recent update to the notification released by the Ministry of Electronics and Information Technology (MeitY) on April 6, MeitY has requested gaming entities to establish self-regulatory organisations (SROs) within a timeframe of 30 days or a maximum of 90 days from the date of the notification, which is April 6, 2023. The Ministry of Electronics and Information Technology (MeitY) has further announced that the central government will certify which online games are permissible until the SROs are officially established. The intention behind establishing SROs is to assist intermediaries, such as Apple or Google, in determining what constitutes a permitted online game, but the SRO will take 2-3 months to complete. In the meanwhile, the Central government will step in and determine what is a permissible online game.

Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 & Intermediary Guidelines and Digital Media Ethics Code Amendment Rules, 2023

By enacting these rules, the Indian government has taken decisive action to protect Indian gamers and their financial resources against scams and fraud. The rules also serve to promote responsible gaming while preventing young and vulnerable users from being exposed to indecent or abusive content.

Amendment Rules developed the concept of a “Permissible online real money game.” This designation is reserved for games that have passed a review process conducted by a self-regulatory body (SRB). Amendment rules indicate that Online Gaming Intermediaries must ensure that they do not permit any third party to host non-permissible online real money games on their platforms. This development is important because it empowers us to distinguish between legitimate and illicit real money games.

The Amendment Rules define an online gaming provider as an “intermediary” under the Information Technology Act of 2000, creating a separate classification called ‘Online Gaming Intermediary’.

Central government to certify what is an ‘Online Permissible Game’

The industry has been wondering what games come under wagering and will be banned. So, until the SROs are officially established, the government, in the interim, will certify what is a permissible game, what is wagering, and what is not wagering. Games that involve elements of wagering are going to be barred. The new regulations prohibit wagering on any outcome, whether in skill-based or chance-based games. Hence gaming applications involving wagering and betting apps will be barred.

Self-Regulatory Organizations (SROs)

According to the new regulations by the Ministry of Electronics and Information Technology (MeitY), online gaming intermediaries must establish a Self-Regulatory Body (SRO) to approve games offered to users over the Internet. The SRO must be registered with the Ministry and develop a framework to ensure compliance with the IT Rules 2021 objectives. An ‘online game’ can be registered by the SRO if it meets specific criteria, which include that the game is offered by an online gaming intermediary that is a member of the self-regulatory body, the game is not containing any content harmful to India’s interests, and complying with all relevant Indian regulations. If these requirements are met, the intermediary can display a visible registration mark indicating its registration with the self-regulatory authority.

Conclusion

MeitY found that with the rapid growth of the gaming industry, the real money gaming (RMG) sector had to be regulated properly. Rules framed must be properly implemented to stop gambling, betting, and wagering apps.

The IT Rules 2021, along with the Amendment Rules 2023, are created to take concrete action to curb the proliferation of gambling, betting, and wagering apps in India. These rules empower to issue of directives to ban specific apps that facilitate or promote such activities. The app ban directive allows the government to take decisive action by blocking access to these apps, making them unavailable for download or use within the country. This measure is aimed at curbing the negative impact of gambling, betting, and wagering on individuals and society, including issues related to addiction, financial loss, and illegal activities. Rules aim to actively combat the spread and influence of such apps and provide a safer online environment for gaming users.

The self-regulatory body in the context of online gaming will have the authority to grant membership to gaming intermediaries, register online games, develop a framework for regulation, interact with the Central Government, address user complaints, report instances of non-compliance, and take necessary actions to safeguard online gaming users.

New Standards - A Leap into the Future

India's Digital Leap: Learn about the nation's new tech standards for TV, USB and more.

January 23, 2023

Introduction

India has been a nation where technology penetration has been a little slower in the previous decades; however, that has changed now. Cyberspace has influenced and touched every country and has significantly diminished the gap between developing nations, developed nations, and underdeveloped nations. This has also been substantiated and strengthened during the Covid-19 pandemic as the world went into lockdown and the cyberspace was the only medium of communication and information. India witnessed a rise of 61% in terms of internet users, and a significant part of this number represented rural India.

New Standards

These standards have been released in threefold aspects covering – Digital Television Receivers, USB Type-C chargers, and Video Surveillance Systems, thus streamlining the use of gadgets and reduction of e-waste for the country.

1. Digital Television Receivers

The Indian standard IS 18112:2022 specification for digital television, and this standard would enable reception of free-to-air TV and radio channels just by connecting a dish antenna with LNB mounted on a suitable area with good signal reception. This will help in the transmission of knowledge about government initiatives and schemes, the educational content of Doordarshan, and the repository of Indian cultural programs. Doordarshan is in the process of phasing out analog transmission, and free-to-air channels will continue to be broadcast using digital satellite transmission. The keen aspects of educational and awareness programs run by the Govt and CSOs will impact more Indians than before as the Ministry of Information and Broadcast intends to increase their free channels of Doordarshan from 55 to 200 by the end of this year, which shows the importance of developments in the mass media industry.

2. USB Type C

Standard (IS/IEC 62680-1-3:2022) for USB Type-C receptacles, plugs, and cables adopting the existing global standard IEC 62680-1-3:2022. This standard provides for the requirements for USB type C ports and cables for use in various electronic devices like laptops, mobile phones, and other gadgets. This standard is similar to the new European standard, which is also aimed at the reduction of carbon emissions and e-waste; this move will result in ease for the industry and the end users. This will also contribute towards the strengthening of the cyber security aspects and prevent threats like ‘Juice Jacking’ to a massive extent.

3. Video Surveillance System

IS 16190, this standard provides a detailed outline of the aspects of a video surveillance system, such as requirements for its components like camera devices, interfaces, system requirements, and tests to ascertain the camera’s image quality on different devices. This series of standards would assist customers, installers, and users in establishing their requirements and determining the appropriate equipment required for their intended application and also provide means of evaluating the performance of the VSS objectively. This will also help in the improvement of surveillance by the individuals, and this will also help in the better investigation by Law enforcement agencies and faster apprehension of criminals, thus contributing to an overall safe society.

The Advantages

These standards are in power with the Internationally prevalent standards, thus taking the safety factors to the global aspect. This will also allow the Indian industry to create world-class products which can be shared all across the globe. This will open India to various opportunities and job avenues, thus opening the world to invest in India. The aspect of Atma Nirbhar Bharat and Digital India will be strengthened to a new level as the nation will be able to deliver products in power with quality in developed countries. The end Indian consumer will benefit the most from these upgraded standards in terms of Digital Televisions, Type ‘C’ USB chargers, and Video surveillance systems, as these impacts the consumers’ daily activities in terms of security and access to information.

Reduction in Carbon Emission
Production of World Class components and devices
Boost to the economy and Atmanirbhar Bharat
New avenues and opportunities for startups and MSMEs
Better transmission of Knowledge
Boosting FDI
Improved quality of products for the end consumer
New innovation hubs and exposure to global talents

This government move simply shows how India is working toward securing the Sustainable development Goals (SDG) by United Nations. This clearly shares the message to the world that India is ready for the future and will also be a helping hand to various developing and underdeveloped nations in the times to come.

Conclusion

These standards will significantly contribute towards the reduction of E-Waste and unnecessary accessories for daily use gadgets. This strengthens the reduction in carbon emissions and thus contributes towards the perseverance of the environment and working towards sustainable development goals. Such standards will lead the future towards securing the netizens and their new and evolving digital habits. In the current phase of cyberspace, the most essential aspect of establishing Critical Infrastructure as the same will act as a shield against the threats of cyberspace.

Navigating the Path to CyberPeace: Insights and Strategies

Featured Blogs

Introduction‍

The Dispute‍

ARGUMENTS BEFORE THE COURT

Conclusion‍

References‍

Introduction‍

End-to-End Encryption: Architecture and Benefits‍

The Process‍

The Dark Side: Crime, Misuse, and the Moderation Dilemma

Comparison of Regulatory Approaches Worldwide

4.1 Authoritarian Countries' Responses

4.2 Democratic Countries' Approaches

4.3 The United Kingdom Approach

Judicial and Legislative Perspectives: India and Beyond

Constitutional Validity of the Ban

Policy Recommendations and the Path Forward

Conclusion

References

Explore Topics

Introduction‍

The Dispute‍

ARGUMENTS BEFORE THE COURT

Conclusion‍

References‍

Introduction‍

End-to-End Encryption: Architecture and Benefits‍

The Process‍

The Dark Side: Crime, Misuse, and the Moderation Dilemma

Comparison of Regulatory Approaches Worldwide

4.1 Authoritarian Countries' Responses

4.2 Democratic Countries' Approaches

4.3 The United Kingdom Approach

Judicial and Legislative Perspectives: India and Beyond

Constitutional Validity of the Ban

Policy Recommendations and the Path Forward

Conclusion

References

Introduction

First Gig Economy Treaty at Glance‍

The Genesis: How the Convention Came to Be

Scope and Definitional Framework

Key Substantive Provisions

Enforcement Architecture and Its Limitations

Geopolitical and Comparative Context

Conclusion

‍

References

‍

Introduction

The Industrialisation of Ransomware-as-a-Service

‍

AI as a Force Multiplier in Ransomware Development

The OPSEC Paradox: How Cybercriminals Leave a Trail

The Russian Safe Haven: Conditional Impunity and Its Limits

Attribution as a Deterrence Instrument

Conclusion

References

Introduction

The I4C Advisory: Core Findings and Threat Architecture

The scale of India's Digital Financial Ecosystem

How Do Deepfakes Defeat Biometric Systems?

Recommendations by I4C

‍

‍

The Legislative Dimension: India's Evolving Response to Synthetic Media

‍

Institutional and Technical Recommendations

Conclusion

‍

‍

References and Sources

Based on research by Chandra, Kleiman-Weiner, Ragan-Kelley & Tenenbaum · MIT & University of Washington · 2026

Sycophancy: the original sin of modern AI

Enter the ideal Bayesian: the rational person who still gets fooled

How does the computational model work?

‍

The Limitations of Truth and Awareness

What this means, and what should actually be done

Introduction
‍

The Dispute
‍

Conclusion
‍

References
‍

Introduction
‍

End-to-End Encryption: Architecture and Benefits
‍

The Process
‍

Introduction
‍

The Dispute
‍

Conclusion
‍

References
‍

Introduction
‍

End-to-End Encryption: Architecture and Benefits
‍

The Process
‍

First Gig Economy Treaty at Glance
‍

^{The Legislative Dimension: India's Evolving Response to Synthetic Media}

Introduction
‍

What Is a Mule Account and Why Should You Care?
‍

Conclusion
‍