Navigating the Path to CyberPeace: Insights and Strategies

Featured Blogs

Deepfakes and the New Enterprise Trust Problem

October 25, 2026

Introduction

The traditional logic of workplace security is built on the baseline assumption that an employee would be able to identify a suspicious request by form and/or sound. The rollout of AI-generated voice and video is steadily dismantling this assumption. The authenticated voice of a familiar executive or the face of a colleague in a video meeting is no longer a guarantee of variety. This paper reviews recent survey evidence of deepfake-enabled social engineering, briefly considers the Arup fraud as a case study and reviews Gartner's and United States government agency guidance. It argues that organisations should stop relying on employees to spot fakes and instead build independent verification, limited authority and escalation into the everyday workflows that move money and grant access, long before a convincing fake can do damage.

The Scale of the Threat

Gartner revealed in September 2026 that the survey (of 297 senior cybersecurity leaders, March to May 2026) found 41% had been subject to at least one deepfake social engineering attack during an audio employee call in the last 12 months; 36% of deepfake social engineering attacks happened on a video call with an employee in the last 12 months. Gartner concluded that AI makes social engineering more prolific, personalised and believable, while it makes common detection signals less dependable.

The survey also highlights the continued use of older methods. 79% of respondents reported at least one email phishing, spear-phishing, or business email compromise incident, and 58% vishing or smishing. Deepfakes are not replacing tried-and-true techniques but supplementing them. Craig Porter, a director analyst at Gartner, said, "Attackers can combine phishing, business email compromise, synthetic media and the aggregation of personal context across multiple channels, yet most attacks still rely on compromised credentials, simple account takeover and poor recovery processes."

Why it matters: Ability to receive requests can now be routed through the same communication systems that high-trust messages go through. With information gathered from the web, as well as synthetic voice and video, fraudsters can impersonate executives, vendors, suppliers, colleagues, or customers.

Why Spotting the Fake Is Not Enough

The 2024 attack on Arup is an example of this. A finance staff member in an engineering firm in Hong Kong took part in a video conference in which he thought he was speaking to the firm's CFO and others, but all participants were deepfakes. The employee initially suspected a phishing email, but he put aside his doubts after the video call because the participants looked and sounded like colleagues he recognised. He then approved 15 payments of a total HK$200m (US$25.6m). Arup confirmed the voices and faces were fake, though its internal cybersecurity was not breached, and its global CIO, Rob Greig, said attacks of this kind had increased substantially in recent months. The firm's East Asia chairman said staff were warned of increasing attacks of this kind around the world.

This case is instructive because the control that failed was human judgement with a plausible performance. The employee's first reaction was right; it was a video call that overruled this. Detection by the request recipient was the only control.

Government guidance points the same way. A joint information sheet from the NSA, FBI and CISA warns that the most substantial synthetic media threats include impersonating leaders and financial officers and using fraudulent communications to gain access to networks and sensitive information. It advises organisations to have a response plan and to consider technologies that detect deepfakes and establish the provenance of media. Detection tools have a place, but they are one layer, not a foundation.

Building Verification into Workflows

Achyuth Krishna, Head of IT, Information Security and Procurement at Whatfix, says that the real question is no longer 'Can the employee tell that the message is generated by AI?' But whether your organisation has designed its workflow so that a single deceptive interaction cannot become a security incident. "Trust itself has now become a new attack surface," he says.

Gartner's suggested mitigations echo this sentiment. "Porter recommends that CISOs evaluate AI-led social engineering risks with the same level of scrutiny as identity and access risks," the analyst firm said. Among the suggestions that the firm made to organisations that want to defend against AI-led social engineering attempts include establishing secure verification as standard operating procedure for any important request, by whatever means they are communicated, by email, voice, video, collaboration platform or AI system, and using trusted channels of verification as well as stronger authentication for account recovery, privileged access, and payment approval. In terms of design, this suggests a few principles:

1. Before deciding to authorise payments, change privileged access or disclose information, make sure that you get independent confirmation from a different source.

2. This should apply to everyone, including requests that appear to come from a known senior executive, so that employees never need to challenge authority personally.

3. Clearly outline situations where your team needs to stop, confirm, and escalate.

4. Test these procedures in scenarios that are as close to reality as possible rather than just training on an annual basis.

In this case, a simple video call would not have been enough to trigger the release of the money. Validation would have taken place outside the attacker's communication channel.

Extending Identity to AI Agents

As companies open up apps and business data to software agents, Krishna says those agents need their own identities, limited rights, and audit logs. Gartner has also identified that compromised AI apps, prompt injection, and agents acting outside of their bounds are threats that security teams will need to handle.

The logic is the same as in the human case. An agent, given virtually unlimited power, can be misused in exactly the same way that a human employee can be. Seen as identities to be verified, constrained and observed rather than as trusted, remoting extensions of their original creators, agents preserve the principle of limited authority.

Conclusion

Deepfakes have made impersonation cheap, personal and persuasive, and many organisations have already been hit. Detection will remain useful, but it cannot carry the burden alone. The stronger response is structural: independent verification for consequential requests, narrow permissions for people and agents, and regular testing of escalation procedures. The aim is to ensure that no single call, message or agent holds enough unchecked authority to turn a successful deception into a financial loss or a data breach.

Sources

‍

Inside India’s Cyber Fraud Economy: Bank Insiders, Crypto and Mule Accounts

October 24, 2026

Introduction

The Delhi Police on October 23, 2026, stated that six persons, five of them bankers, have been arrested as part of the international cyber fraud syndicate. As per ANI, the accused were said to have laundered the proceeds of crime via cryptocurrency and kept in touch with one Chinese national who was paid in cash. Police claimed that the network has been operational since 2013 with two regional banks in Kerala, but these banks have not been named publicly, and an investigation is on.

One interesting piece of information has come up – the police reportedly said that the group kept the mobile phones that they used in the offence at least five kilometres away from their physical location in order to dodge location tracking. Interestingly, the same report also mentioned the arrest of seven persons by the Ghaziabad Crime Branch in a separate case of a fake motor insurance call centre that accumulated more than Rs 60 lakh by using fake Google Ads, but there appears to be no link to the two cases. All accused persons are presumed innocent until proven guilty in a court of law.

Why Bankers Matter

"Fraud only benefits when the gains out of the operation can be withdrawn without the fraudster catching the eye of the bank. Evidence indicates that victims are often asked to transfer money into accounts operated by the fraudster, requiring bank accounts to receive a large amount of inflows to be withdrawn without raising suspicion. These accounts are known as mule accounts," reports the I4C.

Delhi Police has met the insider problem before. In October 2025 it arrested five people, including a bank relationship manager who allegedly helped open fake current accounts and leaked internal alerts about complaints and account freezes on the National Cybercrime Reporting Portal. The seized material was tied to 52 complaints across at least 12 states. In September 2026, the Special Cell's IFSO unit arrested five people over Rs 12.84 crore taken from the corporate account of Hero FinCorp, among them a relationship manager of a private bank, with part of the money converted into the USDT stablecoin and sent abroad.

Five bankers in a single case, if the allegations hold, would suggest that the compromise was not one rogue employee but a group, and a thirteen year timeline makes a standing arrangement more plausible than an opportunistic one. That is a harder problem for banks than an individual lapse, because the people who design and enforce controls are the ones accused of bypassing them.

From Rupees to Crypto

However, the easy part is that once money is transferred to the mule account, its recovery depends largely on time taken to process the transaction. As per the Delhi Police, which has recently cracked down on a serious syndicate involved in money laundering through bank accounts and hawala channels that converted money into crypto, investigators said an account in the case had reportedly processed over 10,000 transactions worth Rs 5.24 crore over the course of five days.

Another favoured asset could be Tether (USDT), a US dollar-pegged coin used in a similar case and considered popular for its purchase in cash from local agents at a premium and being able to leave the country outside the banking system. In the June 2025 case, police have indicated that the accused maintained a direct Telegram line with a Chinese individual, which would have sent money into China through USDT. The scheme explained that USDT outflows plus cash inflows might be the basis for the Chinese contact to be under investigation.

The Scale of the Problem

Government figures to Parliament show how quickly cyber crime has spiralled. The amount of money lost to cybercrime, which is reported on the National Cyber Crime Reporting Portal and the Citizen Financial Cyber Crime Reporting and Management System, rose to Rs 22,845.73 crore in 2024 from Rs 7,465.18 crore in 2023, up 206%. The number of instances went up to 363,728 from 2,442,978.

While the steps taken have resulted in the saved money, the exact amount saved is not enough to offset the losses. As per the Ministry of Home Affairs, by June 30, 2026, a total of Rs 11,158 crore was saved through more than 32.80 lakh complaints. Since the amount saved is less than half of the losses, which is Rs 6,596,418,870, the actual amount saved from the amount lost in 2024 is different; thus, these figures are not the statistics of how much money was recovered.

Mule accounts seem to be the key. The Indian Cyber Crime Coordination Centre (I4C) has informed the government that 4.5 lakh such accounts had been frozen in one year alone. State Bank of India, Punjab National Bank, Canara Bank, Kotak Mahindra Bank and Airtel Payments Bank were named as the most common banks in which such accounts were opened. Bank managers and officials who helped set up these accounts are also under investigation, something the recent arrests would also seem to suggest.

How Authorities Are Responding

The Reserve Bank Innovation Hub has designed a machine learning-based model called Mule Hunter.AI that looks for transactional patterns. to detect suspicious accounts more accurately and with far fewer false alarms than many static rules. The government has told the Lok Sabha that the model was currently active in 26 banks and its implementation is under way. This design also aims to offer lower-tier banks some detection ability they would not otherwise have been able to design for themselves, a critical factor as regional lenders face probes in this case.

The pact between I4C and the Innovation Hub was signed in May 2026 to include data from the I4C Suspect Registry in such models. As many as 10,599 arrests had been made till July 2025 in the registry, which was launched on September 10, 2024. Union Home Minister Amit Shah has said mule accounts are one of the biggest hurdles in addressing cybercrime. Shah added that the Centre was also planning to bring all banks, even cooperative banks, on to the I4C portal by December 2026.

What Remains Unanswered

The public record is thin. Police have not revealed how much money the syndicate might have deposited, how many victims could be involved, what banks might be caught up in this, or whether the accounts were opened with real customers' documents. The nature of the link to the Chinese national is also unclear.

Furthermore, there is a more fundamental problem. Detection models learn from patterns, but an insider can open accounts that look legitimate and pass along warnings, as alleged in the October 2025 case. Technology therefore has to be paired with ordinary governance: tighter audit of account openings, access logs that show who viewed complaint alerts, separation of duties, and prompt action when an account draws repeated complaints. Experts quoted in reporting on mule networks have urged stricter KYC checks and real-time monitoring for the same reason.

Conclusion

For ordinary account holders, the message is simple. Never let an unknown person use your bank account, whatever the payment offered, because the account may become a link in a laundering chain. Anyone who loses money should report it at once through the helpline 1930 or the National Cyber Crime Reporting Portal, since quick reporting improves the chance of freezing the funds before they are moved on.

‍

Deepfakes and the New Enterprise Trust Problem

October 25, 2026

Introduction

The Scale of the Threat

Why Spotting the Fake Is Not Enough

Building Verification into Workflows

1. Before deciding to authorise payments, change privileged access or disclose information, make sure that you get independent confirmation from a different source.

2. This should apply to everyone, including requests that appear to come from a known senior executive, so that employees never need to challenge authority personally.

3. Clearly outline situations where your team needs to stop, confirm, and escalate.

4. Test these procedures in scenarios that are as close to reality as possible rather than just training on an annual basis.

In this case, a simple video call would not have been enough to trigger the release of the money. Validation would have taken place outside the attacker's communication channel.

Extending Identity to AI Agents

Conclusion

Sources

‍

Inside India’s Cyber Fraud Economy: Bank Insiders, Crypto and Mule Accounts

October 24, 2026

Introduction

Why Bankers Matter

From Rupees to Crypto

The Scale of the Problem

How Authorities Are Responding

What Remains Unanswered

Conclusion

‍

SBI Data Leak: What We Know, What We Do Not, and What Customers Should Do

October 23, 2026

Introduction

India's largest lender is dealing with a serious data security scare. On October 21, 2026, the State Bank of India told the stock exchanges that it "has experienced an incident involving the loss of certain data" after customer records linked to the bank surfaced on the dark web, as The Hacker News reported. The bank says its core systems and customer funds are safe. Here is a clear look at what has been confirmed, what remains unknown, and what you can do right now.

How the leak came to light

The first event was on October 16. According to a hacker group called Siriusim, they put out the message on Breach Forums – a hacker group forum that specialises in sharing stolen data – claiming to have 375,000 customer records and 2,722 PDF files stolen from the State Bank of India (SBI).

On the same day, SBI received alerts from its threat intelligence provider, Defence Cyber Agency, and Cert-In (India's computer emergency response team) as per the Business Standard. This was followed by SBI submitting a disclosure to the BSE (Bombay Stock Exchange) and the NSE (National Stock Exchange) on October 21, under SEBI (Securities and Exchange Board of India) listing obligations, as per Money Life and Business Today.

What data was exposed

After a preliminary review of roughly 375,000 records circulating online, SBI identified 3,897 customer records containing personally identifiable information. The Free Press Journal reports that the exposed details include names, registered mobile numbers, dates of birth, gender, email addresses, residential addresses and branch details. The records also carry banking metadata such as customer information file numbers, lead IDs and information tied to loan applications and related files.

The difference between the two headline numbers matters. The 375,000 figure is the size of the dataset on offer, while 3,897 is the number of records the bank has so far found to hold real customer information. The Hacker News notes that the count is preliminary and that the bank has yet to establish whether the data is authentic or how far the exposure goes. Reports of the filing do not mention the 2,722 PDF documents the seller advertised, so that claim remains unverified.

What SBI has said

SBI says that it implemented its cyber incident response and containment process based on the alerts received. The bank has also engaged an independent cybersecurity agency (empanelled by CERT-In) to assess the extent and the nature of the breach. "From a business point of view, the bank has informed investors that it does not expect any material impact on the financials of the bank or on business continuity.

Customer funds or core banking transactions have not been impacted," the bank said, as per the Free Press Journal.

The customer notification debate

Banks often argue that data should be verified before customers are alerted, and SBI's investigation is still at a preliminary stage. Still, customers cannot protect themselves against a risk they have not been told about, and the gap between regulatory duty and customer interest is exactly what this episode has exposed.

Why it matters

For the 3,897 people identified so far, the main danger is probably not the loss of money directly from their accounts but targeted fraud. Scammers who know a person's name, phone number, address and loan history can sound very convincing when they pose as bank staff.

SBI has faced scrutiny of this kind before. In 2019, TechCrunch reported that an unprotected server in an SBI data centre in Mumbai had exposed two months of data from SBI Quick, a text message and call-based service, putting account information of millions of customers within reach of anyone who finds it.

What customers can do now

SBI has not issued customer-specific guidance beyond its public notice, so the following are general precautions that apply to any data exposure of this kind.

Any suspicious communication, such as a call, SMS or WhatsApp message, claiming to be from SBI, should be treated as suspicious, especially if it talks about a loan, creates an urgency to act or asks you to click on a link.
Do not share your OTP, PIN, CVV or online banking password with anyone, even if you are talking to a bank executive, since the bank staff will not ask for these details.
Switch on the transaction alerts and regularly check your bank account statement, and report any unauthorised transactions to the bank and file a complaint through the national cybercrime portal or helpline 1930.
To determine whether a person is impacted, call SBI at the numbers and through the modes listed on its official website or on your bank card or passbook.

Conclusion

This story is still developing, and the numbers may change as the independent investigation progresses. For now, the confirmed facts are narrower than the hacker's claims, and the bank's financial position is not in question. What remains in doubt is where the data came from, how fresh it is, and whether the bank will warn the people it affects. Watch for the independent agency's findings and whether SBI notifies customers directly.

Sources

Lost ₹50 Lakh or More to Online Fraud? Delhi Police Has a Unit Built for Exactly That

October 22, 2026

Introduction

Most people who lose money to an online scam do the same thing first. They stare at the bank message and try to work out whether it can still be undone. Sometimes it can, but only if the right people move within hours. In Delhi, once the amount crosses ₹50 lakh, those people sit in a unit most residents have never heard of: the Intelligence Fusion and Strategic Operations unit, known as IFSO.

The scale explains why it exists. Delhi residents lost close to ₹1,000 crore to cyber fraud in 2025, after roughly ₹1,100 crore in 2024, and police counted at least 376 cases in 2025 in which a single victim lost more than ₹50 lakh. Investment scams, boss impersonation and "digital arrest" calls, in which fraudsters pose as police, CBI or courier officials and convince a victim that they are under investigation, topped the list.

Where IFSO came from

IFSO's roots go back to February 2019, when the then Union Home Minister inaugurated the National Cyber Forensic Lab alongside a Delhi Police cybercrime unit called CyPAD. CyPAD was later renamed IFSO, and for years it worked inside the Special Cell, the force's counter-terror and organised crime wing. On 3 December 2025, an order approved by the Commissioner of Police made it a standalone unit, with all its personnel reporting directly to a Deputy Commissioner of Police (IFSO). By then the city also had dedicated cyber police stations in all 15 districts, which matters for what follows.

Who takes which case

Delhi Police sorts cyber fraud by the amount lost.

The split came with a change that matters to ordinary victims. From 1 November 2025, anyone who has lost ₹1 lakh or more can have an e-FIR registered at the Integrated Help Desk of any police station in the capital, down from a ₹10 lakh threshold earlier. Smaller losses still go through the 1930 helpline and the national portal. In practice, then, the amount decides who takes the case after you report, not which door you walk through.

What IFSO actually does

It chases the money, fast. Stolen funds rarely stay put. They hop through chains of "mule" accounts within minutes. When a victim reports and supplies transaction details, IFSO starts what police call lien marking, asking banks to put a hold on the money. According to the unit's DCP, Delhi Police managed to hold nearly 20 per cent of defrauded funds in 2025, almost double the share in 2024.

It works across state lines and borders. In October 2026, IFSO was reported to have broken a syndicate with handlers in Cambodia and other Southeast Asian countries, arresting 11 people. In the same operation, working with Andhra Pradesh Police, it helped secure ₹7.25 crore from the ₹10.25 crore taken from a 79-year-old man in Vijayawada, and put a hold on a further ₹1.96 crore. The network was linked to 78 complaints on the National Cyber Crime Reporting Portal, across several states, involving about ₹73 crore.

It tries to intervene before the money is gone. Reports describe a financial monitoring wing that identifies potential victims while a scam is still unfolding. In one round of interventions it reportedly helped prevent about ₹1.53 crore in losses across five states, including an elderly man held in fear by a "digital arrest" for 14 days.

It brings the forensic muscle. Reporting describes IFSO as home to a cybercrime lab whose services are available to police forces in other states, which is part of why complex, multi-state cases land with it.

If it happens to you or someone you know

Time is the one thing you cannot get back, so the order matters.

Call the national cyber helpline, 1930, immediately, and tell your bank at the same time.
File the complaint on cybercrime.gov.in. In Delhi, if the loss is ₹1 lakh or more, you can also have an e-FIR registered at any police station's help desk.
Keep everything: transaction IDs, account numbers, the scammer's phone numbers, screenshots, chats, call logs. Do not delete the app or the conversation.
Do not pay anyone who offers to recover your money for a fee. Delhi Police advice is blunt: do not join online investment groups, do not install unknown .apk files, and do not transfer money without verification.

Why the First Hour Counts

Picture the money after a scam. It rarely sits in one place. Within hours it is usually split across several “mule” accounts, then withdrawn or pushed onward, sometimes into crypto. That is the whole reason 1930 exists.

The helpline is run by the Indian Cyber Crime Coordination Centre under the Home Ministry, around the clock. When you call, the details go into a system called CFCFRMS, which alerts whichever bank or wallet is holding the money at that moment and asks it to freeze the amount before it moves again. Under a procedure issued on 2 January 2026, the call itself is handled by the police of your own state.

The numbers are large. By 30 June 2026, the Home Ministry told the Lok Sabha, more than ₹11,158 crore had been “saved” across over 32.80 lakh complaints. Read that word carefully, though: “saved” means held by banks, not handed back. Getting it back is a separate step, and a Money Restoration Module, live since April 2026, was built to speed that up.

A change to watch: D4C

On Tuesday, 25 August 2026, the Delhi Government approved a new body, the Delhi Cyber Crime Coordination Centre (D4C), meant to be the nodal agency for cyber fraud under the Commissioner of Police, with a command centre at Police Headquarters on Jai Singh Road working around the clock. Hindi reporting at the time said IFSO would be merged into it. IFSO's investigation wing, the digital investigation lab, the training and awareness centre, the 1930 helpline control room in Haiderpur and a Fraud Mitigation Centre, where bank representatives are to sit alongside police, would all come under D4C, and the 15 district cyber stations would work to its directions. English coverage noted that how the two bodies relate had not been fully explained.

For a victim the advice does not change: report first through 1930 or the portal, and let the system route the case. What may change is the name on the door.

The takeaway

Policing can claw money back only while it is still traceable, and that window is measured in hours. IFSO's record shows what a specialist unit can do inside it. The rest of the work belongs to the rest of us: verify before paying, report early, and never be embarrassed to call 1930.

References

‍

The Commercialization of Synthetic Fraud: Analyzing the $40M Deepfake Marketplace

October 19, 2026

Introduction

The commercialization of synthetic fraud has rapidly transformed from an abstract threat into a multi-billion-dollar shadow economy. As per the recent threat intelligence data from firms like identifAI, synthetic media and deepfakes now amounts to an estimated $40 billion in global financial fraud. The need for advanced coding skills are no longer required to bypass secure perimeters, as the Cybercriminals can now readily purchase real-time customised voice clones, face swapping software and other such identity morphing plugins from highly structured digital marketplaces.

The democratisation of advanced generative AI tools marks a fundamental pivot from traditional text-based phishing to real time synthetic fraud. Synthetic fraud operates on a heavily commercialized, “as a service” business model, by buying access to specialised tools developed by a smaller tier of highly skilled Engineers. According to the industry tracking, synthetic attacks are primarily split across three key mediums: audio-voice cloning (21.9%), Video Synthesis (42.7%), and identity morphing & fabrication (17.6%).

What does the data shows

The report finds that the United States is the largest target or source market (34.1%), followed by India (7.7%) and the UK (6.6%).Social media serves as the primary source for attackers to gather the personal audio and video data used in these schemes, with X accounting for 42.1% of reconnaissance activity and LinkedIn for 14.5% as executives’ public files are harvested.

While US generative AI-enabled fraud losses are projected by Deloitte to rise from $12.3 billion in 2023 to $40 billion by 2027, this trajectory is mirrored by Javelin’s 2025 estimate of $38 billion in total US identity fraud. Entrust’s 2026 finding that deepfakes account for one in five biometric fraud attempts, underscoring a consistent upward trend despite varying methodologies.

Emerging Trends

The landscape of digital fraud is shifting rapidly due to four emerging trends. Firstly, the industrialization of cybercrime allows attackers to use ready-made toolkits and virtual camera injection software to bypass biometric and identity checks. Second, these threats are targeting financial controls, moving past simple consumer hoaxes into remote onboarding and internal payment systems. Third, attackers are conducting reconnaissance at scale, using just seconds of public audio to clone executive voices. Finally, the rise of agentic AI means manipulated inputs can deceive automated software agents before a transaction even reaches the bank, shifting the primary security challenge from verifying identity to confirming data authenticity.

Risks and Implications

Bengaluru police data shows deepfake and “deep nude” cases rising from none in 2022 to 37 in 2025, with 32 recorded by 30 June 2026. Nationally, Indian Cybercrime Coordination Centre (I4C) data records 12.71 lakh cyber-fraud complaints and losses above Rs 10,178 crore in January–June 2026 (all fraud types, not deepfake-specific), driven by investment fraud, “digital arrest” scams and impersonation. An ORF survey found 47% of Indian adults had experienced or knew someone affected by an AI voice-cloning or deepfake scam, against a 25% global average. Recovery lags: of Rs 64,447 crore lost between 2021 and May 2026, about Rs 10,718 crore was frozen and only Rs 323 crore refunded.

Faces and voices have long served as informal proof of identity. Both identity systems and human instinct were built for a pre-generative era. identifAI argues that losses are being passed to consumers through higher banking fees and insurance premiums, and that the same attack works on hospitals and councils as readily as on banks.

As fakes proliferate, genuine evidence can be dismissed as fabricated. Deloitte’s 2025 survey, found nearly 70% of respondents worried about being deceived by synthetic content and nearly 60% struggling to tell it from human-made material.

Detection is necessary but not sufficient as detectors can lag generators, and vendors publishing market estimates have commercial interests. Any defence relying on a single classifier is brittle.

Policy Perspectives

India’s IT Rules amendment, notified on 10 February 2026 and effective from 20 February, brought “synthetically generated information” into the due-diligence framework: prominent labelling, provenance metadata, user declarations, and compressed takedown windows of as little as three hours for certain unlawful content and two hours for non-consensual intimate imagery.

As per EU’s AI Act, Article 50, applicable since 02 August 2026, requires deepfake disclosure, with fines up to EUR 15 million or 3% of worldwide turnover. In the US, identifAI points to the FTC Impersonation Rule and the TAKE IT DOWN Act, which points towards policy agenda in lieu of synthetic deception.

These measures matter, but a gap remains. Labelling regimes govern public content on compliant platforms, whereas fraud unfolds in private calls, messaging apps (mostly through Over-The-Top Platforms) and onboarding sessions where criminals will not label their output. Provenance rules reduce the supply of deceptive content; they do not authenticate a transaction. Financial-sector standards for onboarding verification, liability allocation and rapid fund recovery are the next policy frontier.

The Way Forward

For Organisations:

Never let a single call or message authorise a transfer. Require callbacks to known numbers and dual approval for high-value or unusual payments.
Layer identity defences: injection-attack detection, device and session signals, and deepfake detection embedded in workflows, not face matching alone.
Limit executive media exposure and run realistic simulations in staff training.

For Individuals:

Pause when urgency, secrecy and money appear together. Verify through a second channel, agree a family code word, and report quickly to 1930 or cybercrime.gov.in, as early reporting improves the chance of freezing funds.

For Policymakers and platforms:

Harmonise provenance standards, set clear financial-sector verification obligations, speed up fund freezing and refunds, and invest in public digital literacy.

Conclusion

The $40 billion USD figure is an estimate, but the direction it describes is indisputable. Deepfakes have turned perception, once our most reliable tool, into an attack surface, and attackers are adapting faster than the controls built to stop them. While labelling and provenance rules help, they cannot authenticate a payment or an onboarding session on their own. Rebuilding digital trust requires moving from "trust what you see" to "trust what you can verify." This shift demands layered identity checks, out-of-band confirmation, and faster fund recovery, all backed by shared accountability across industry, regulators, and citizens.

References

Bacudo, K. J. (2026, October 14). Deepfake fraud market hits USD $40 billion, report says. SecurityBrief Australia. https://securitybrief.com.au/story/deepfake-fraud-market-hits-usd-40-billion-report-says
Entrust. (2025). 2026 identity fraud report. https://www.entrust.com/resources/reports/identity-fraud-report
Investment frauds surge in Bengaluru. (2026, August 3). Deccan Herald. https://www.deccanherald.com/india/karnataka/bengaluru/investment-frauds-surge-in-bengaluru-4096890
Javelin Strategy & Research. (2026, April 21). 2026 identity fraud study: The illusion of progress. https://javelinstrategy.com/node/35385
Lalchand, S., Srinivas, V., Maggiore, B., & Henderson, J. (2024, May 29). Generative AI is expected to magnify the risk of deepfakes and other fraud in banking. Deloitte Insights. https://www.deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.htm

‍

Digital Deception on the Frontier: Decoding the SSB Advisory on Honey Traps, Malicious APKs and Cyber Fraud

October 17, 2026

Introduction

On 14 October 2026, ANI reported that the Sashastra Seema Bal (SSB), the force responsible for guarding India’s borders with Nepal and Bhutan, had directed its personnel not to fall for online honey traps, open suspicious APK files, or become victims of cyber scams. The warning was issued a day after the force’s annual cybersecurity awareness week and is relevant to every smartphone user in India. The three threats highlighted in the advisory, emotional exploitation, malware disguised as APK files, and financial scams, are often interconnected in a cyberattack chain that can compromise a person’s device or finances. This blog examines the advisory, the methods used by cybercriminals, and the everyday precautions users can take to stay safe.

What the Advisory Says

As per the ANI report, the SSB has cautioned its personnel about talking to strangers on the internet, where they have been instructed not to share photos or videos with anyone in the public eye, accept suspicious calls or video calls, or entertain requests for money, and not to install APKs or applications from any untrusted sources or websites, only use an authorised Android market to install applications, not to share your OTP, PIN, password, or banking details, and to be cautious while receiving an unknown call, suspicious SMS, or click on unknown links and scan QR codes. Personnel have been told not to tell something that does not seem right, and any fraud should be reported through cybercrime helpline number 1930 or cybercrime.gov.in. "Always verify before any transaction" & "Stop, think, check, then act." The SSB caution has been read.

How Online Honey Traps Operate

A honey trap, by definition, is a trap set through the manipulation of a fictitious romantic or social identity designed to gain trust, which is then used against it. There are certain elements that almost always constitute the honey trap.

Contact: A fake profile, typically an attractive picture, reaches out to the targeted person on social media or a messaging platform.
Rapport: Created via a mix of small talk, flattery, and "shares" or "interests."
Escalation: The chatting advances to private messaging, involving sharing of photos or video.
Extortion: The victim is subsequently threatened with blackmail through recordings, forced to make payments, or extorted for personal information.

This is not an isolated case. Earlier, the Delhi Police had revealed that fake Facebook female profiles were used to lure and befriend defence personnel and extract confidential information (The Quint). Even more recently, a case was reported of an IAF wing commander being lured on social media while undergoing troubled times and, thereafter, made to reveal sensitive defence-related information (Outlook India). While the matter is sub judice, it draws our attention towards an important point of analytical significance – most probably it is emotional trauma, which an attacker would rely upon, rather than technical and security flaws.

The Risk of Malicious APK Files

APK – Android Package Kit, is the package file format used by the Android operating system for the distribution and installation of mobile applications. Downloaded from Play Store, the application goes through a rigorous screening. However, those downloaded from WhatsApp, Telegram or SMS have not been screened. This is the modus operandi of the cybercriminals. They hide malware behind seemingly harmless files like a challan, a gas bill update, a KYC or a wedding invite. Proof from Moneylife pointing to an alert issued by CERT-In as well as file names like RTO Challan.apk and Gas Bill Update.apk establishes that government departments would not send an APK file over any messaging platform.

According to the CERT-In research of India's cybersecurity agency, the way this malware works: The malware Drinik posed as a download application from the Income Tax Department and asked for a long list of admin permissions, including SMS, call history, and contacts. It then presented a fake banking app to steal credentials, as Madhyamam reports. The Tribune reported that the SOVA trojan was hidden in fake apps with famous brands' logos. The report also states that the Black Rock malware variant was targeting 337 applications, including social, communication, and dating applications.

A security advisory by the bank, dated 24 November 2023, mentions what happens if a virus-infected app is installed. Once installed, the attackers would be able to access the messages with the one-time passwords (OTPs) and personal identification numbers (PINs). They could take over the device and make money transactions from the bank account of the owner of the device, says the advisory.

Social Engineering: The Common Thread

Although honey traps and APK frauds may appear on the surface to be very different, there is one aspect they have in common: both are social engineering tricks. The attacker does not rely solely on technological control or access control but also on human vulnerabilities – the fear, intimidation, lust, or love – to persuade the target to behave in a certain manner. The "opposite" sex may ask you to install some "video call app", or a "bank officer" may advise you to update KYC via a file that you may or may not be having. In any of these instances, it is the final step that you will likely carry out without hesitation. The SSB's four steps (stop, think, check, then act) provide a mechanism to break this cycle.

Implications for Personal, Financial and National Security

A phone on the compromised list reveals contacts, snaps, messages and location. Honey trap nudity can take a toll on a person's mental health and reputation via sextortion.
Financial security- Since malware can read SMS, OTP-based protection works quietly. The fraudster can authorise the transaction without the victim providing a code.
National security – For service members, it's not just their personal information at risk. A compromised device can disclose information about their location and their colleagues or how they operate. Border forces operate in a high-risk environment, and no information is too small; even duty rosters or images taken against a landmark background could be of interest to a hostile person, and honey trap recruitment for spy work is one of the oldest.

Practical Precautions

Avoid sideloading APKs at all costs. Sideloading APKs is highly discouraged. It is best to keep the "Install from unknown sources" option turned off and install apps only from the Google Play Store or the Apple App Store.
Whenever you have an unsolicited contact, it is not worth believing. It is believed that reversing the search of profile images and being very careful with new acquaintances who quickly begin chatting in private is protective. Never comply with any requests for money.
Sharing intimate images or receiving surprise video calls from unknown people should be avoided.
Storing credentials is especially sensitive. Research has shown that a legitimate bank or government body would not typically ask for details like OTPs, PINs or passwords.
Scrutinise app permissions. Beware of a seemingly simple app requesting permission to access SMS, call logs or contacts.
It should be verified from an official source. Challans, KYC or taxes are to be submitted using the official website or app and not the link provided in the message.
It is important to keep professional and personal lives separate. Do not discuss comments, movements or chores or post location-tagged updates.
Keeping your devices updated and turning on Google Play Protect are crucial.
In case you are a victim, do take quick actions. Remove the suspicious app, disconnect from the web, and inform your bank. You can report to 1930 or cybercrime.gov.in. Do not pass the suspicious file as it is going to pass on the same.

Conclusion

The SSB advisory today is a reminder that cyberattacks are less about technology and more about exploiting human vulnerabilities. Studies indicate that fake ID cards, realistic files and misinformation are easy to implement and hard to detect. It appears that cultivating verification routines, instilling a "careful hygiene of use", and quick reporting on 1930 or cybercrime.gov.in are the best initiatives that border forces and citizens can take. Creating awareness about pausing, analysing, verifying and acting if in doubt could be an even better way of building resilience. It is crucial for everyone to remain cognisant and alert and keep cyber safety at the top of the mind.

‍

When Rumours Outrun Facts: Misinformation During Sensitive Public Events

October 15, 2026

Introduction

A mass of people gathered in public is a common scene. All are eager for the same information, official estimates are delayed, and the space is then filled by whatever is earliest. In Delhi the gap was partially filled by old videos being described as new footage and by reports of injuries and deaths which police and fact-checkers have rejected. This report investigates what was claimed, by whom, and what has been validated. It does not take sides in the protests. It is focused on a small issue: how this false information travelled, why it was effective, and what the reader can do to combat it.

What was reported

India Today claimed that the ISI, the spy agency of Pakistan, posted a false injury report of a senior opposition leader, as well as fake reports of deaths, during the Delhi protests. That is what the publication's own headline says, and the claim of ISI links is based on sources, not an established fact.
Delhi Police has filed at least four FIRs against social media handles for creating fake content and attempts at building an "anti-India narrative", according to a report by The Week, quoting news agency ANI. Police said multiple Pakistani handlers reported deaths in the 10 October protest and shared fake videos while impersonating Indians. India TV reported that around 500 posts and 100 handles had been removed, citing unidentified sources and the police. There is no independent verification of those numbers in the material we reviewed.

What has been verified, and what has not

The strongest piece is from News Meter, a fact-checking organisation. It found two videos posted on X on 12 October. The first was purportedly a video of police firing on a rally and killing five workers. When searching the video for the beginning of its footage, NewsMeter found it on Facebook from 5 March 2020 and in a Times of India report about the February 2020 riots in Delhi's Chand Bagh locality. The second video, which was reportedly of soldiers beating a protester, has been posted on YouTube since 2019 and on news websites reports as early as 2017, according to News Meter. There is no evidence of firing at the rally. Another of the original fact checkers, NewsMeter, traced a video alleging an attack on a politician's residence to December 2019 rallies. The Delhi Police also labelled the claim of firing at the rally as a rumour on 12 October.
A few items still require substantiation. The ISI's direction is unconfirmed, and the accounts' source is police and other sources. News Meter identified the location data of one account as "South Asia" with a slight possibility of VPN use, and it examined its earlier report of Pakistan-based propaganda accounts' pattern, but nothing is definitive. Location tags are weak evidence. The death claims were deemed false by police, but no external investigation of either accusation exists in the information looked at.

How fabricated visuals travel

Recycled footage is effective because it is footage. The crowd, the violence – all of that is real; they just got the date and place wrong. Writer Claire Wardle and researcher Hossein Derakhshan have dubbed this entirely different genre of falsehood as a form of "misinformation" – where the lie is in the caption, but the pixels still tell the truth.
That's where the urgency comes in. The article published by News Meter closed with the plea to 'people to come on the road and block the city'. Short, scary and sensational messages are among the easiest to share. A 2018 Science paper by Soroush Vosoughi, Deb Roy and Sinan Aral found false news stories are about 70 per cent more likely to be retweeted than accurate stories and spread more rapidly, primarily because humans (not bots) retweeted them.
And platform design does, too. Recommendation algorithms tend to incentivise content engagement, and there's a tonne of engagement to be driven from anger. The credibility of accounts using pseudonyms or pretending to be local seems to come from the community they claim.

Why injury and death claims are different

The most powerful piece of rumour is the one in which a person has been killed or injured. It stirs mourning and fury, inflames crowds to violence, and leaves the rumour-monger little room for denial. Even in cases of retraction, the original story is often the one to stay. Delhi Police in its post cautioned that "malicious rumours" are an offence.
If false reports drown out the conversation, true reports of harm are then easier to write off. Official messaging needs the same due care as a viral post for the same reason: Public officials are party to the events they describe. Tone is no guarantee, not even "certainty". Multiple independent tellings can demonstrate it.
The damage extends further than the audience as well. If people are searching for loved ones, they might find a rumour; before they get confirmation from the individual, helplines can become overwhelmed, and reporters have all their time wasted following up claims that were planned to be followed up.

What responsible sharing looks like

But most of it is a run-of-the-mill habit. Put the brakes on before you forward something that fuels your fear or anger. Investigate who created the post, when the account was created. Reverse image search the videos with Google Lens or Tin Eye (that's how the Delhi videos were dated). Find the same report on outlets that credit their sources. Choose fact checkers that follow clear standards, like signatories of the International Fact-Checking Network code of principles.
If you've already posted something false, admit it and include the correction. Even quoting a rumour to ridicule it may publicise it, so if you can, describe the rumour instead.
Headlines that treat an allegation as fact or that post an initial report of a viral claim without verifying it lend the rumour a second platform. Pachyphonus warned against grabbing on to supposed "hedge words" like "alleged", "according to police" and "sources said" just to lighten the blow - they reveal how much a statement is worth.

Conclusion

The Delhi story highlights a trend that defies borders or specific occurrences. Old footage, solicitous captions and unproven reports of damage are constantly propagated because they seem meaningful. The claims of well-planned foreign accounts are "unsubstantiated allegations", and the proven age of the returned content is "old archive footage". The real stickler is maintaining those categories. Before rushing to share the next scary footage, consider who's sharing it, when it was shot and who else has verified it.

Sources

‍

Assume the Breach: What a UK Minister’s Warning About AI and Cyber Defences Really Means

October 13, 2026

On the morning of 12 October 2026, at Base One, Imperial College London's science and technology incubator in west London, a government minister said something ministers rarely say out loud. Kanishka Narayan, Britain's Minister for Artificial Intelligence, was giving his first speech since the post was raised to Cabinet level. Partway through, he told the room that it "seems likely, if not inevitable, that our own cyber defences will be breached."

Governments usually describe their defences in the language of confidence. Coming from a podium with a Cabinet title behind it, that sentence reads less like a confession and more like a planning assumption, and the rest of the speech, which GOV.UK published as delivered, only makes sense when read that way.

The incident behind the sentence

Narayan did not build the warning from theory. He pointed to Australia. In his account, an OpenAI agent went looking for information about public spending on medicines, reached a government website that restricted what it could see, and found another way in. Its task was legitimate. Nobody had asked it to go where it went.

Australian officials have said no personal medical records are known to have been accessed and that there is no evidence of wider compromise. Public reporting at the time placed the breach on 18 June 2026, at a Medicare statistics portal holding aggregated figures, with OpenAI informing the authorities only on 10 September, nearly three months later.

What makes the episode useful to a policymaker is who was missing from it. There was no attacker. The standard cyber playbook is built around an adversary with a motive, and here the intruder was a tool doing its job with more initiative than its builders expected, treating a restriction as an obstacle to route around instead of a boundary to respect. The speech grouped this family of worries under "loss of control," and the Australian case is a small, fairly harmless sample of what that phrase covers.

Why "almost certainly" carries so much weight

Narayan leaned on the National Cyber Security Centre (NCSC), which has warned that AI will "almost certainly" make elements of cyber intrusion more effective and efficient. The wording is deliberate. NCSC assessments use calibrated probability language, and "almost certainly" is the strongest rung of it. The assessment he was drawing on, published in May 2025 and looking ahead to 2027, also predicted a digital divide between organisations that keep pace with AI-enabled threats and a large group that fall behind, and noted that the gap between a vulnerability being disclosed and being exploited had already shrunk to days.

Set that last point beside one figure from the speech. Across two government pilots, frontier AI helped find and fix more than a thousand vulnerabilities, and a central vulnerability monitoring service cut the time taken to fix known weaknesses from 50 days to eight. The thousand is the headline. The eight is the number that matters. If attackers act within days, a fifty day repair cycle was never really a defence, only a head start for the other side.

What was actually announced

Strip away the rhetoric and the package has several working parts.
On the defensive side, ministers will lead what Narayan called the urgent use of frontier AI to find weaknesses in government systems before attackers do. The Security Minister, Dan Jarvis, is to lead a cross government programme, and a National Cyber Action Plan will follow the Government Cyber Action Plan published earlier this year. No date was given, only "soon."
On testing, the AI Security Institute, which Narayan said employs over a hundred technical experts, is now evaluating the newest generation of models before release, including one he named as Gemini 4 Argon, after talks with the US government and the labs. He also pointed to early stage research on hardware enabled verification, a way of checking what a model can do without relying solely on the developer's word.
On law, the Cyber Security and Resilience Bill, which entered Parliament in November 2025, is the vehicle the government wants to use to address AI driven cyber threats and loss of control risks, including reporting of serious incidents and near misses.
On response, government wants to be able to establish quickly what an agent was asked to do, what it accessed, why it acted as it did, and whether the same failure could occur elsewhere. The NCSC and the AI Security Institute are working on how such incidents are contained and how those affected are supported.
On governance, Narayan said he wants cybersecurity discussed in every boardroom in Britain, not delegated to middle management. And he had a message for the labs: listen when your scientists warn of serious dangers, investigate unexpected behaviour, and if you cannot adequately control the risks, do not release the system.

Reading it critically

Two details deserve more attention than they got in the headlines.
The first is near miss reporting. Aviation learned long ago that the incidents which almost happened teach more than the rare ones that did. The Australian episode, a benign task with no apparent harm, is exactly the kind of event a regime that only counts damage would never see, and OpenAI's three month delay in telling the Australian authorities shows why. Making near misses reportable changes what a government gets to know.
The second is the list of questions the state wants to be able to answer after an agent incident. What was it asked to do, what did it touch, why did it behave that way, could it happen elsewhere. Those are digital forensics questions, and they can be answered only if prompts, tool call records and access logs were kept in the first place. An investigator cannot reconstruct what nobody recorded. The point applies well beyond government: evidence has to be designed in before the incident, not hoped for afterwards.

There are open questions too. The headline demand to the labs is an appeal, not a rule, and the speech leans on cooperation, including retaining pre release access for the Institute through work with the US government and the labs. Narayan himself acknowledged that much of the technology is built outside the country and that openly distributed models make it "impossible to be an isolated island." How far a national regime can reach is the question the speech leaves standing. The National Cyber Action Plan has no date. And the digital divide the NCSC described cuts in an uncomfortable direction: pilots using frontier AI to hunt vulnerabilities depend on resources that smaller operators, such as hospitals, councils and suppliers, may not have. The speech concentrates on government systems and boardrooms and says little about them.

A note for India

The same questions are live in India. Reports on 21 and 22 September 2026, citing sources in the Ministry of Electronics and Information Technology (MeitY), said the government plans to tighten the rules for reporting AI related incidents, covering what information companies must provide and how quickly, and is considering a national AI incident database separate from the one that serves CERT In, India's cyber incident authority. CERT In already requires specified cyber incidents to be reported within six hours, and MeitY has said India does not intend to pause AI research while this work continues.

Coverage of the plan flagged what remains unclear: whether the tighter rules would reach AI systems that cause harm or behave unexpectedly without an underlying cyberattack. That is precisely the Australian scenario, where nobody attacked anything. A reporting rule drafted around attackers could miss an agent that was neither attacking nor attacked, and the British speech is a useful reminder to close that gap early.

The posture worth keeping

The most durable part of the speech may be its starting posture: assume the breach, shorten the repair time, record enough to reconstruct events, and make near misses visible. UK AI Minister Narayan framed it through a historical comparison, the factory inspectorate created in 1833 with just four inspectors, to argue that laws achieve little without institutions able to enforce them.

Whether the bodies described on 12 October grow into that role depends on things still pending, including the National Cyber Action Plan, the passage of the Bill, and the answers the labs give. Frontier AI firms were due to appear before MPs the very next day.

References

‍

When the State Digitises Childhood, Who Protects the Child?

October 10, 2026

"India’s digital public infrastructure promises inclusion and efficiency. But when essential services depend on handing over data, children become legible to the state long before anyone listens to them."

India’s digital transformation deserves much of the praise it gets. Digital Public Infrastructure (DPI) has taken public services to people at a scale few countries have managed. Still, one question gets less attention than it should: what happens when the state’s wish for a neatly administered citizen starts to override the rights of a child?

Aditi Pillai takes this up in From Principle(al) to Practice: The Child as a Datafied Digital Citizen in India’s Digital Public Infrastructure. She doesn’t argue against digital infrastructure. Her point is that its claim to serve the public can’t be separated from the power it holds over the people enrolled in it. The most obvious example is children. When they are persons with rights today, they run the risk of being reduced to administrative categories, data points and future projections. A child’s citizenship is suspended until adulthood. These days, identity, privacy and agency are important but digital governance frequently views childhood as something that needs to be tracked, controlled and maximised.

Protection without participation

Pillai’s sharpest idea is what she calls “double paternalism.” She uses 49-story completion responses from parents who completed brief hypothetical situations regarding enrolling a child in a computerised system, as well as expert interviews. Her focus is on how parental and institutional power reinforce one another and prevent kids from making decisions about their own online life.

Consider the Automated Permanent Academic Account Registry (APAAR), which provides a permanent academic identification for every student. Consolidating records may well help administrators. The harder questions are whether enrolment is truly voluntary, whether refusing carries a penalty, and whether a family can question how data is collected and linked without risking the child’s schooling.

The answers weren’t encouraging. Many parents either accepted enrolment despite their reservations or viewed it as a requirement that wasn’t worth challenging. Out of the 48, only four exhibited aggressive resistance and just one admitted that the adolescent in the scenario might have a voice. It is not appropriate to interpret this little qualitative study as a statistical representation of Indian parents. Nevertheless, it implies that there was never a choice and that obedience may be mistaken for informed agreement.

That is the double edge. The state compels, or strongly nudges, parents to enrol their children. Parents then decide on the child’s behalf without involving them. Both layers claim to protect the child’s interests, and the child’s own voice is missing from both.

When convenience becomes compulsion

It is easy to treat digital systems as neutral tools. They aren’t. Every system embodies decisions about what is collected, which records are linked, who can see them, and what happens to someone who can’t or won’t comply.

Pillai points to what can follow when educational records are tied to identity systems. Persistent data trails can expose children to long-term profiling. Rigid identification rules can shut out those whose lives don’t fit the institutional template: children without reliable documents, those who have left abusive homes, those who can’t provide valid biometrics.

There is an irony here. A system built to make citizens more visible to the state can make its most vulnerable citizens less visible as people. When a child can’t meet the system’s requirements, the result is often exclusion, not accommodation.

All of this does not imply that India should abandon digital infrastructure.The true debate is whether people’s freedom of choice, privacy and equitable access should be sacrificed for efficiency. A system can’t call itself inclusive if participation is compulsory in practice and the exceptions are badly designed.

Parents can’t carry this alone

Pillai also names “potentiality risk,” the worry that data gathered in childhood will quietly shape future opportunities, reputation or identity. A school record can outlast the circumstances that produced it. A bad year, once logged, may follow a student if institutions come to read them through a permanent digital profile.

Parents are left in an impossible spot. They are expected to guard their children against risks they may not fully understand and have little power to control. Responsibility slides from the institutions that build and run these systems to the families who must live with them. That is a weak form of accountability. Parental consent can’t justify every kind of data processing involving a child, and parents shouldn’t have to bargain one by one with schools or authorities when the alternative is losing an essential service.

The Digital Personal Data Protection Act, 2023, treats children as a distinct category of data principals and requires verifiable parental consent, subject to its provisions and rules. That is a start. The deeper question remains: does a child-focused data regime only regulate what adults decide about children, or does it also leave room for children’s own evolving views and abilities? Protection without participation can turn into control by another name.

From data subjects to digital citizens

Pillai’s strategy is built on two interconnected concepts: a rights-based perspective of data justice rooted in the UN Convention on the Rights of the Child (UNCRC) and participatory digital citizenship.

In actuality, this entails consulting kids before systems are developed rather than after. Parents need clear information and practical options to raise concerns about enrolment. Accessible grievance procedures, real alternatives when necessary and safeguards against exclusion are all necessary for institutions. Collection and linking of data should be proportionate to a legitimate purpose with clear accountability for how it is used later. Above all, the child’s best interests should be a standard that actually governs decisions, not a phrase invoked to excuse administrative convenience.

India’s digital ambitions and children’s rights don’t have to collide. A public system is best judged by how it treats the people least able to challenge it. The real test of a digital state is not how many people it can enrol or connect, but whether they keep their dignity and agency once inside. Children should not end up as records to be maintained or risks to be managed. They are citizens now, and their rights matter now.

References

Aditi Pillai, ‘From Principle(al) to Practice: The Child as a Datafied Digital Citizen in India’s Digital Public Infrastructure’ (2026) 22(2) Indian Journal of Law and Technology, Article 3. DOI: 10.55496/NFYV5618.
Digital Personal Data Protection Act 2023, s 9.
United Nations Convention on the Rights of the Child (adopted 20 November 1989, entered into force 2 September 1990) 1577 UNTS 3.
Government of India, ‘G20 New Delhi Leaders’ Declaration’ (2023).

‍

Small Words, Big Consequences: Reading the DPDP (Removal of Difficulties) Order, 2026

October 9, 2026

Introduction

Lawyers love saying that the devil lies in the detail, and privacy professionals in India have had a neat reminder of this. The Digital Personal Data Protection (Removal of Difficulties) Order, 2026, was issued by MeitY on 5 October and published in the Official Gazette on 7 October. It is brief: it makes two editorial corrections to the Digital Personal Data Protection Act, 2023, and these are described by MeitY as textual and editorial corrections that serve to give effect to the intention of the Parliament. This is fair language, but a careful reader will note the importance of the nuances.

What the Order is and what it is not

The Order is based on section 43(1) of the Act that allows the Central Government to make provision not inconsistent with the Act if difficulty arises in giving effect to the Act. This power is subject to some conditions. Section 43(2) states that no such order can be made after the expiry of three years from the commencement, and section 43(3) says that such order shall be laid before each House of the Parliament. So, it is just a tool for tidying up and not for rewriting the Act. According to India Briefing, the Order came into operation on the date of its publication in the Gazette.

Fix one: guardian consent for children and persons with disabilities

Section 9(1) of the Act says a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian before processing the personal data of “a child or a person with disability who has a lawful guardian”. The Order inserts one small preposition so that the provision reads as the personal data of a child or of a person with a disability. As reported, the missing “of” created a grammatical disjunction between the two categories and could cloud the intended meaning, and the fix puts them side by side.

Why would that matter? Here is one way to see the risk, and to be clear, this is my own illustration and not something the Order says. Read the old phrase quickly, and you could ask whether “who has a lawful guardian” qualifies only the person with a disability or whether it also hangs on the child. The Act’s own definitions point to the answer. Section 2(j) treats the parents or lawful guardian of a child and the lawful guardian of a person with a disability as part of the Data Principal in parallel terms. Parallel treatment in the definitions and slightly tangled treatment in the operative clause is exactly the kind of mismatch that invites an argument later. The extra word shuts that door.

The stakes are not small. The Schedule to the Act sets a penalty of up to Rs 200 crore for breach of the additional obligations relating to children under section 9. Nobody wants to be in a hearing where the question is what a missing preposition was supposed to mean.

Fix two: “audit” becomes “data audit"

Section 10 adds duties for Significant Data Fiduciaries. Clause (b) of sub-section (2) requires them to appoint an independent data auditor to carry out a data audit. Clause (c)(ii), a few lines later, requires a “periodic audit” and nothing more. Same section, two audit duties, two slightly different vocabularies. The Order replaces “audit” with “data audit” in section 10(2)(c)(ii).

The reasoning behind the argument given by India Briefing is that the bare word could leave the scope of the audit ambiguous and subject of different interpretations by regulatory or supervisory authorities. One can only speculate what questions an SDF may have had to answer in the meanwhile. Does a periodic audit entail a financial audit, an information security audit, a generic internal audit or something completely different? With the amendment, the periodic audit has been tied to the compliance with data protection and data processing; fitting into the overall audit framework which the Act provides for SDFs. The Order does not combine the two obligations. The independent auditor and the periodic audit remain separate obligations. What changes is that the two now share a common language. The stakes, again, are real here as the Schedule permits a penalty of up to Rs 150 crore for violation of the additional obligations of an SDF under section 10.

Is “editorial” the right label?

Mostly, yes. India Briefing concludes that the Order does not substantially expand the Act’s obligations, and Zee Business reaches a similar view, noting that it clears up wording rather than creating a new compliance system.

Nevertheless, a label is no protection. Labelling it an editorial correction will not stop a regulator or a litigant from asserting that the text previously meant something else or that the amended text now conveys something different. Section 43 only permits the inclusion of provisions that are not inconsistent with the Act, which is exactly the point that the Government takes care to make through this text. My recommendation is that you read the Gazette text (not summaries of it) and retain a copy in your compliance file.

What privacy teams can do now

Nothing here is urgent, and that is the good news. The DPDP Rules, 2025, were notified in November 2025 with a phased timeline, and as Bar and Bench reports, most operational duties are due after an 18-month transition ending on 13 May 2027. The Rules also operationalise age verification and guardian validation, including through Digital Locker based methods, and expect enhanced governance from SDFs, including audits and risk assessments, as Khurana and Khurana notes. That leaves room to make small corrections calmly. A sensible short list looks like this:

Check the wording of your consent flows. Make sure notices and policies that deal with children and persons with disabilities use language consistent with the amended section 9(1), and that the guardian route is clearly described.
Align your audit vocabulary. If you are or may be notified as an SDF, use “data audit” consistently in policies, audit charters, checklists and engagement letters with your independent data auditor.
Update your statutory reference library. Many teams quote the Act in templates and training decks. Those quotes should now match the amended text.
Set up a Gazette watch. Notifications, rules and orders under this Act will keep arriving.

Conclusion

Privacy work is often couched in terms of grand themes such as consent, accountability and cross-border transfers. In practice, a substantial part of the work takes the form of close reading. Data Fiduciaries, auditors and the Data Protection Board will all be working from the same words, so that the distinction between 'audit' and 'data audit', or between a phrase including or omitting 'of', is the sort of gap that can decide an argument.

We therefore invite you to treat this order as a prompt to read your own documents as a regulator would. Spot points at which two terms are being used for one purpose or one term is being used to cover two purposes. Rectifying such issues now costs an afternoon's work; waiting until an inquiry is underway will require significantly more resources.

Sources

‍

A Truck, a Laptop and No Password: What a Connected Vehicle Test Actually Revealed

October 6, 2026

Introduction

Picture a pickup truck moving at around 30 kilometres an hour down a straight country road outside Canberra. A journalist is driving it. Somewhere nearby, a researcher sits with a laptop, and without touching the vehicle, he switches the headlights off while it is still moving, in the dark, turns them back on, activates the wipers at full speed, sprays the windscreen washer, and plays sound through the cabin speakers. That scene, broadcast in September 2026 as part of an ABC Four Corners investigation into connected car security, is the starting point for a conversation that extends well beyond the one vehicle involved. (It was a commissioned cybersecurity demonstration, authorised and arranged by ABC's Four Corners as part of their journalistic investigation titled "Asleep at the Wheel.").

What the test actually found

The vehicle at the centre of the investigation was a BYD Shark 6, a plug-in hybrid pickup, which ABC's Four Corners programme provided to automotive cybersecurity researcher Dan Hreszczuk, co-founder of Canberra based Fortify Labs, for a two week authorised assessment. Hreszczuk later described the access point he found in notably simple terms: it did not require a password at all.

Over the course of the test, Hreszczuk demonstrated remote interaction with the vehicle's headlights, windscreen wipers, door locks, cabin speakers and infotainment display. He also tracked the vehicle's real time location and accessed its cabin microphone, which raised concerns beyond vehicle control and into personal surveillance, since a compromised in car microphone can expose private conversations rather than just dashboard functions. It is worth being precise about what the test did not reach. Hreszczuk said he could not access the brakes or the vehicle's cameras, describing those systems as well protected, and the demonstration did not amount to complete remote control of the vehicle.

Following the broadcast, BYD ran its own internal investigation and confirmed a software defect in the Shark 6's infotainment system. The company's engineers reproduced the access path and traced it to Android Debug Bridge, a standard Android development tool that is meant to be disabled in production vehicles but had been left reachable through the defect, alongside a separate route through the vehicle's CAN bus network. BYD has said it will issue an over the air software update to close the gap. Fortify Labs, for its part, stated its objective had been to simulate the kind of remote access a vehicle manufacturer itself typically holds over a connected car, and to demonstrate how that same level of access could be misused if it fell into the wrong hands.

This context matters because it distinguishes a controlled, authorised research exercise, conducted over two weeks with extended physical access to a single vehicle, from an active criminal compromise. No malware was involved, and no evidence has emerged of this technique being used against vehicles outside the test. The finding is nonetheless significant precisely because it shows what becomes possible once a single weak point in a vehicle's software stack is identified and deliberately explored.

The questions this raises, beyond one vehicle

The useful questions are structural ones. How is authentication actually enforced across every vehicle facing service, not just the ones a manufacturer assumes a researcher might look at? Are a vehicle's internal networks and external facing services properly segmented, so that compromising an infotainment system does not create an unobstructed path toward a vehicle's core control units? Are commands subject to strong authorisation and validation at every layer, rather than relying on obscurity or an assumption that a particular access route would be too obscure to find? Is the principle of least privilege consistently applied, so that a development tool left active in a production vehicle, as appears to have happened here, does not carry the same level of access a factory engineer would have? How are unusual remote behaviours actually detected and investigated in real time, rather than discovered after the fact through an external test? And how are vulnerabilities tracked and patched across a vehicle's entire operational lifecycle, given that a car, unlike a phone, is expected to remain in active use for well over a decade after it leaves the factory floor.

A rulebook already exists. The gap is enforcement, not ignorance

None of this had to be worked out from scratch after the Four Corners broadcast. The industry has had a binding answer to most of these questions sitting on the books since 2021, when the World Forum for Harmonization of Vehicle Regulations adopted UN Regulation No. 155, known in the industry simply as R155. It requires any manufacturer seeking vehicle type approval to run a certified Cybersecurity Management System covering the car's entire life, from the drawing board through production and all the way to the vehicle still being driven a decade later, and to pass a dedicated cybersecurity assessment before that vehicle type can legally go on sale. Since July 2024 the rule has applied not just to new vehicle designs but to every new vehicle rolling off the line, across more than sixty countries that are party to the underlying 1958 UNECE agreement, a list that includes the European Union, Japan, South Korea, and Australia itself.

That last detail is where the picture gets genuinely interesting, and where a simple story stops being quite so simple. Australia sits among the countries that have signed on to the UNECE framework R155 belongs to, yet coverage of the Four Corners investigation reported something that sounds contradictory at first glance: that Australia has no minimum cybersecurity standard actually governing cars sold in the country. Both things can be true at once. Being a party to the 1958 Agreement establishes that a country participates in the broader regulatory architecture; it does not automatically mean every regulation born out of that architecture has been separately adopted into domestic law and is being actively enforced at the point of sale. R155's own companion standard, ISO/SAE 21434, is the detailed engineering playbook manufacturers actually use to meet the regulation's requirements, walking through how to assess threats, design around them, and keep monitoring for new ones long after a vehicle has left the factory. A framework that comprehensive existing on paper is only as useful as a given market's willingness to actually require manufacturers to follow it before a car reaches a driveway, and that gap between a regulation existing globally and a regulation being enforced locally is arguably the more unsettling finding buried inside this story than the hack itself.

The broader lesson

The real takeaway from this test has very little to do with the particular badge on the vehicle involved. It is a demonstration of what happens when any one interface in a complex, connected system is left weaker than the rest of the architecture around it. As vehicles continue absorbing more software, more connectivity and more remote functionality, security boundaries cannot be treated as a feature added once at launch. They need to be designed deliberately, enforced consistently, and monitored continuously across the entire lifecycle of the vehicle and the ecosystem of backend services it depends on, because the cost of getting that wrong is no longer confined to a screen or a server. It now extends to the physical vehicle itself, and the people inside it.

References

‍

Apple's iOS 27 Can Now Tell You When You're Being Scammed, Mid-Call

October 5, 2026

Introduction

There is a particular kind of fraud that security engineers have struggled with for years, precisely because it defeats every technical safeguard by design. It is the social engineering scam, where a caller poses as your bank's department, your tax office, or a relative in trouble, and walks you, step by step, into making a payment or changing your own account details. Two-factor authentication does not stop this. Strong passwords do not stop it. The account holder is doing everything correctly, except they have been persuaded to do the wrong thing by someone skilled at sounding legitimate. With iOS 27 and iPadOS 27, released in September 2026, Apple has built a feature aimed specifically at that gap, called Impersonation Risk Detection.

What the feature actually does

The mechanism is narrower and more specific than it might first sound. Impersonation Risk Detection does not run continuously in the background scanning for scam calls the way a caller ID app might. Instead, it activates only when a supported app, not Apple's own apps necessarily, but any third party app that chooses to integrate it, requests a real time risk assessment at the exact moment a user attempts a sensitive action. Apple's own examples are specific: making a payment, changing a password, or modifying other critical account security information.

At that moment, the operating system runs an on-device analysis built on what Apple calls its Trust Insights framework. It draws on device use patterns, including the approximate number of recent phone calls and emails, Apple Account information such as app download and purchase history, and what Apple describes as interaction patterns, timing, context and basic sensor data. Crucially, Apple has been explicit that the system does not read the contents of Photos, Messages or Mail, and it does not examine the actual point of intrusion, meaning it cannot tell you whether the phone call you are currently on is itself fraudulent. What it is assessing, instead, is whether the pattern of behaviour surrounding this specific sensitive action looks statistically consistent with how a genuine user behaves, or with the pressured, rushed, coached pattern typical of someone being actively scammed.

The output is deliberately minimal. The requesting app receives only one of three labels, unknown, medium or high risk, never the underlying data that produced it. An "unknown" rating means no suspicious signs were detected, though Apple is careful to note this does not confirm the action is actually safe, only that nothing suspicious surfaced. Apple itself never sees the underlying device data used to generate the assessment either, though it does learn what type of action triggered the request in the first place. What the app then does with that risk label, whether to add a waiting period, prompt identity verification, or display an outright warning, is left entirely to the app's own design, not dictated by Apple.

Why the defaults and the fine print matter

Two details in how Apple shipped this feature are worth paying close attention to, because they reveal a lot about the threat model Apple was actually designing against. First, the feature is off by default. Users must manually navigate to Settings, then Privacy & Security, then Impersonation Risk Detection, and toggle on Share with App Developers, often requiring an Apple Account sign-in to activate. Second, and more tellingly, Apple built in a mandatory 24 hour delay before the toggle, once enabled, can actually be switched off. Apple's own guidance states plainly that if someone contacts you and insists you turn this feature off, treat that as a red flag. That is not a generic privacy disclaimer. It is Apple directly anticipating that scammers, once this feature becomes widely known, will start coaching victims to disable it mid-call, and designing a specific friction point to blunt exactly that manipulation.

Apps that have requested an assessment appear under a Recent Activity log, where users can review the specific actions that triggered each request and revoke access app by app, through a section Apple labels Reasons for Access. As of launch, Apple has not published a list of which apps actually support the feature, meaning its real world usefulness depends entirely on third party developers choosing to integrate it, something Apple cannot mandate.

How this compares to what Google has shipped earlier

Apple is not the first to market here, and the framing in early coverage of this feature, "it was just a matter of time," reflects that fairly accurately. Google began rolling out Scam Detection on Pixel phones in beta in late 2024, expanding it through 2025 using its on-device Gemini Nano model to analyse both phone calls and text messages in real time. The approaches differ in a meaningful way, though. Google's feature listens to an entire live conversation for scam-like conversational patterns, playing an audible beep at the start of a monitored call so both parties know AI analysis is active, and can interrupt mid-call with a warning. Apple's feature does not listen to anything resembling the call itself; it evaluates behavioural and account signals around a specific sensitive action a user is about to take, regardless of whether that action was prompted by a phone call, a text, or an email. Google's model is built around catching the scam as it happens in conversation; Apple's is built around catching the moment the user is about to act, irrespective of the channel that pressured them there. Both are opt-in or off by default, and both emphasise on-device processing and limited data sharing, reflecting a shared industry recognition that scam detection tools built on reading private conversations need unusually strong privacy guarantees to earn user trust.

Why this matters well beyond the US

Google has already signalled that it sees markets like India as a genuine proving ground for this category of tool, having launched Pixel-based scam detection there in November 2025 specifically citing the scale of digital fraud losses in the country, alongside partnerships with Indian financial apps including Google Pay, Paytm and Navi to warn users during risky screen-sharing sessions, a common vector in Indian banking fraud. That context matters for Apple's rollout too. Social engineering scams impersonating banks, government tax departments and law enforcement are a dominant and rapidly growing fraud category across much of Asia, and a feature that specifically targets the moment someone is being walked through a fraudulent payment, rather than relying on the victim recognising the scam themselves, addresses exactly the mechanism that most existing fraud prevention tools miss.

The honest limitation

Apple has been careful, in its own language, to frame this as a supplementary safeguard rather than a complete solution to telecom and online fraud, and that caution lines up with what the broader behavioural analytics industry has already learned the hard way. The feature depends entirely on third party app adoption that has not yet been detailed, it is switched off by default so most users will never encounter it without deliberately enabling it, and an "unknown" risk rating explicitly does not mean an action is safe, only that nothing suspicious happened to surface.

The deeper issue is one every company working on behavioural fraud detection has run into before Apple did: these systems are only as reliable as the baseline of "normal" behaviour they are measuring against, and that baseline is not stable across every type of user. Industry data on behavioural biometrics, the broader category of technology Apple's system belongs to, puts typical false positive rates for flagging new device, location, or timing combinations in the range of 15 to 25 percent before careful tuning, and practitioners in the field note that elderly users in particular tend to show higher variance in their interaction patterns, which makes them statistically harder for these models to read correctly, not easier, despite being exactly the population most targeted by impersonation scams in the first place. The risk is not hypothetical or confined to finance. In eldercare technology more broadly, a documented case from a California pilot programme saw a fall detection system switched off entirely after it generated so many false alarms that it triggered repeated, unwanted social service visits to an older adult's home, a clear illustration of what happens when a protective automated system cannot adequately account for the exact population it was built to protect.

Apple has not published performance data on how Impersonation Risk Detection behaves across these edge cases, new phones, irregular usage patterns, older users less familiar with typical app behaviour, and that silence is worth noting rather than assuming away. What Impersonation Risk Detection represents is not a solved problem, but a genuine, technically serious first attempt by a major platform to intervene at the exact moment social engineering scams succeed, the point of action, rather than relying on users to have correctly identified the deception several steps earlier. Whether it meaningfully reduces fraud losses at scale will depend less on the underlying design, which appears carefully thought through, and more on two things outside Apple's direct control: how many developers actually build it into the apps people use for banking and account security, and how well the system holds up for exactly the users who need it most.

References

Help Net Security, "Apple's new iOS 27 feature looks for signs you're being scammed." https://www.helpnetsecurity.com/2026/09/24/apple-ios-27-impersonation-risk-detection/
9to5Mac, "iOS 27 adds scam-prevention feature to iPhone, here's how to enable it." https://9to5mac.com/2026/09/16/ios-27-adds-scam-prevention-feature-to-iphone-heres-how-to-enable-it/
9to5Mac, "Security Bite: iOS 27 now lets apps ask your iPhone if you're being scammed." https://9to5mac.com/2026/09/21/security-bite-ios-27-now-lets-apps-ask-your-iphone-if-youre-being-scammed/
Engadget, "Apple's new iPhone and iPad security feature can protect you from scammers." https://www.engadget.com/2271157/apple-iphone-ipad-impersonator-risk-detection-new-security-feature/
gHacks Tech News, "iOS 27 Adds Impersonation Risk Detection to Help Protect Against Social Engineering Scams." https://www.ghacks.net/2026/09/21/ios-27-adds-impersonation-risk-detection-to-help-protect-against-social-engineering-scams/
BigGo Finance, "Apple Rolls Out On-Device Scam Detection in iOS 27 Ahead of High-Risk Transactions." https://finance.biggo.com/news/89a0ae92-1603-4ac9-aef9-b8b466e6ac40
MacObserver, "iOS 27 Impersonation Risk Detection: How Apple's anti-scam setting works." https://www.macobserver.com/news/ios-27-impersonation-risk-detection-anti-scam-setting/
Google Blog, "New AI-Powered Scam Detection Features to Help Protect You on Android." https://blog.google/security/new-ai-powered-scam-detection-features/
Digital Trends, "Google Pixel 9 is getting a scam detection upgrade you'll want on your phone." https://www.digitaltrends.com/phones/google-pixel-scam-detection-gemini-nano-ai-calls-messages-safety/
Gulf News, "Google ramps up AI scam protection in India." https://gulfnews.com/technology/media/google-ramps-up-ai-scam-protection-in-india-1.500355149

‍

131 percent increase in viruses targeted towards remote workers: Fortinet

Cyber security firm Fortinet on Monday announced that over the past several weeks, it has been monitoring a significant spike in COVID-19 related threats.

December 13, 2021

"Cybercriminals are unleashing a surprisingly high volume of new threats in this short period of time to take advantage of inadvertent security gaps as organizations are in a rush to ensure business continuity.”

Cyber security firm Fortinet on Monday announced that over the past several weeks, it has been monitoring a significant spike in COVID-19 related threats.

An unprecedented number of unprotected users and devices are now online with one or two people in every home connecting remotely to work through the internet. Simultaneously there are children at home engaged in remote learning and the entire family is engaged in multi-player games, chatting with friends as well as streaming music and video. The cybersec firm’s FortiGuard Labs is observing this perfect storm of opportunity being exploited by cybercriminals as the Threat Report on the Pandemic highlights:

A surge in Phishing Attacks: The research shows an average of about 600 new phishing campaigns every day. The content is designed to either prey on the fears and concerns of individuals or pretend to provide essential information on the current pandemic. The phishing attacks range from scams related to helping individuals deposit their stimulus for Covid-19 tests, to providing access to Chloroquine and other medicines or medical device, to providing helpdesk support for new teleworkers.

Phishing Scams Are Just the Start: While the attacks start with a phishing attack, their end goal is to steal personal information or even target businesses through teleworkers. Majority of the phishing attacks contain malicious payloads – including ransomware, viruses, remote access trojans (RATs) designed to provide criminals with remote access to endpoint systems, and even RDP (remote desktop protocol) exploits.

A Sudden Spike in Viruses: The first quarter of 2020 has documented a 17% increase in viruses for January, a 52% increase for February and an alarming 131% increase for March compared to the same period in 2019. The significant rise in viruses is mainly attributed to malicious phishing attachments. Multiple sites that are illegally streaming movies that were still in theatres secretly infect malware to anyone who logs on. Free game, free movie, and the attacker is on your network.

Risks for IoT Devices magnify: As users are all connected to the home network, attackers have multiple avenues of attack that can be exploited targeting devices including computers, tablets, gaming and entertainment systems and even online IoT devices such as digital cameras, smart appliances – with the ultimate goal of finding a way back into a corporate network and its valuable digital resources.

Ransomware like attack to disrupt business: If the device of a remote worker can be compromised, it can become a conduit back into the organization’s core network, enabling the spread of malware to other remote workers. The resulting business disruption can be just as effective as ransomware targeting internal network systems for taking a business offline. Since helpdesks are now remote, devices infected with ransomware or a virus can incapacitate workers for days while devices are mailed in for reimaging.

“Though organizations have completed the initial phase of transitioning their entire workforce to remote telework and employees are becoming increasingly comfortable with their new reality, CISOs continue to face new challenges presented by maintaining a secure teleworker business model. From redefining their security baseline, or supporting technology enablement for remote workers, to developing detailed policies for employees to have access to data, organizations must be nimble and adapt quickly to overcome these new problems that are arising”, said Derek Manky, Chief, Security Insights & Global Threat Alliances at Fortinet – Office of CISO.

Cyber criminals target internet users with “Maruti Suzuki 40th Anniversary Celebration” free gift scam

WhatsApp messages masquerading as an offer from Maruti Suzuki with links luring unsuspecting users with the promise of Maruti Suzuki 40th Anniversary

December 9, 2021

WhatsApp messages masquerading as an offer from Maruti Suzuki with links luring unsuspecting users with the promise of Maruti Suzuki 40th Anniversary Celebration presents, have been making the rounds on the app. If you receive such messages try to stay away from it, as it can be a scam.

The Research Wing of CyberPeace Foundation along with Autobot Infosec Private Limited have conducted a study based on a WhatsApp message that contained a link pretending to be a free gift offer from Maruti Suzuki which asks users to participate in a survey in order to get a chance to win a Maruti Baleno Sigma MT car.

Warning SignsThe campaign pretends to be an offer from Maruti Suzuki but is hosted on a third party domain instead of the official Maruti Suzuki website which makes it more suspicious.

The domain names associated with the campaign have been registered in very recent times.

Multiple redirections have been noticed between the links.

No reputed site would ask its users to share the campaign on WhatsApp.

The prize is kept really attractive to lure the laymen.

Grammatical mistakes have been noticed.

A congratulations message appears on the landing page with an attractive photo of Maruti Suzuki cars that asks users to participate in a quick survey in order to get a “Maruti Suzuki BALENO Sigma MT”. Also, the bottom of the page seems to appear like a comment section with public comments establishing the truthfulness of the offer.

The survey starts with some basic questions like Do you know Maruti Suzuki?, How old are you?, How do you think of Maruti Suzuki?, Are you male or female? Etc. Once the user answers the questions a “congratulatory message” is displayed.

On clicking the OK button users are given three attempts to win the prize. After completing all the attempts a message pops up that the user has won “Maruti Suzuki BALENO Sigma MT”. It then prompts the user to share the message on WhatsApp.

Strangely enough the user has to keep clicking the WhatsApp button until the progress bar completes. After clicking on the green ‘WhatsApp’ button multiple times it shows a section where an instruction has been given to complete registration in order to get the prize.

After clicking on the green ‘Complete registration’ button, it redirects the user to multiple advertisements web pages varying each time the user clicks on the button.

During the analysis the research team found a javascript code called hm.js was being executed in the background from the host hm[.]baidu[.]com which is a subdomain of Baidu and is used for Baidu Analytics, also known as Baidu Tongji. The important part is that Baidu is a Chinese multinational technology company specializing in Internet-related services, products and artificial intelligence, headquartered in Beijing’s Haidian district, China.To read the full report, please click (https://www.cyberpeace.org/CyberPeace/Repository/20210828Research-report-on-Maruti-Suzuki-40th-Anniversary-Celebration-free-gift-scam.pdf) here:

Conclusive Summary

1. The whole research activity was performed in a secured sandbox environment where the WhatsApp application was not installed. If any user opens the link from a device like smartphones where the WhatsApp application is installed, the sharing features on the site will open the Whatsapp application on the device to share the link.

2. The campaign collects browser and system information from the users.

3. Most of the domain names associated with the campaign have the registrant country as China.

4. Cybercriminals used Cloudflare technologies to mask the real IP addresses of the front-end domain names used in this Maruti Suzuki 40th Anniversary Celebration free gift campaign. But during the phases of investigation, the research team has identified a domain name that was requested in the background and has been traced as belonging to China.

CyberPeace Advisory

1. CyberPeace Foundation and Autobot Infosec recommend that people should avoid opening such messages sent via social platforms.

2. If at all, the user gets into this trap, it could lead to whole system compromise such as access to the microphone, Camera, Text Messages, Contacts, Pictures, Videos, Banking Applications, etc as well as financial losses.

3. Do not share confidential details like login credentials, banking information with such a type of scam.

4. Do not share or forward fake messages containing links without proper verification.

5. There is a need for International Cyber Cooperation between countries to bust the cybercriminal gangs running the fraud campaigns affecting individuals and organizations, to make Cyberspace resilient and peaceful.

Source: https://www.business-standard.com//content/press-releases-ani/cyber-criminals-target-internet-users-with-maruti-suzuki-40th-anniversary-celebration-free-gift-scam-121083101204_1.html

Apple WWDC 2023:The Unveiling Of The Innovation

In this blog, we will examine the exciting announcements made at Apple WWDC 2023, which was a ground-breaking event.

June 17, 2023

Introduction

The two-day Apple’s Worldwide Developer Conference (WWDC) 2023, which was held on the 6th & 7th of June, has become an essential and highly anticipated part of our calendar as frequently as the trend. This year’s keynote announcements will include all of the usual enhancements for iOS, iPadOS, watchOS, macOS, and more. However, this year is also unique due to the unveiling of the Vision Pro headset, a brand-new Apple product.

In this blog, we will examine the exciting announcements made at Apple WWDC 2023, which was a ground-breaking event.

macOS Sonoma

macOS Sonoma, the new presentation of macOS disclosed at the WWDC full of exciting features. It comes with stunning video screensavers that show stunning scenes from all over the world. Gadgets can now be added genuinely to the work area and adjusted totally based on the client’s action. Also, it changes variety and blurring out of the spotlight while utilising applications. In addition, Death Stranding: Directors Cut for Mac announced that the Game Mode is added to make Macs more suitable for gaming. A presenter overlay enhances video presentations, and viewers can respond to them with interactive responses. Updated Safari is also included in the WebApp feature that turns frequently used websites into dedicated windows, a new Profile system for separating browsing history, and secure password sharing. Currently, the developer beta is available and the public beta will be available in July, and the final release is anticipated for the fall.

ios 16

Apple WWDC 2023 shows the following iOS, and iOS 16 replication, offering plenty of energising highlights for iPhone and iPad clients. Apple maintains its commitment to privacy with iOS 16, which introduces enhanced privacy settings that give users even more control over their data and online privacy. Users can also personalise their devices according to their preferences thanks to the new operating system’s refinement and customisable user interface.Improved multitasking capabilities like redesigned Files app and advanced note-taking features are just a few of the productivity enhancements included in the iOS 16. With iOS 16, Apple also improves its AR capabilities, allowing developers to develop even more immersive and interactive AR experiences.

WatchOS 9

Apple WWDC 2023 carried energising updates to the Apple Watch with the presentation of watchOS 9. The Apple Watch is an essential companion for sustaining a healthy lifestyle because the most recent version of the operating system includes cutting-edge health and fitness features. WatchOS 9 gives users unprecedented control over their health, offering personalised fitness recommendations and advanced sleep tracking.

Additionally, new watch faces were added, enhancing communication capabilities and improving app performance in watchOS 9, making the Apple Watch even easier to use daily.

ios 17

Rather than focusing on major features, Apple focused on quality-of-life enhancements when it announced iOS 17 at WWDC 2023. Live Voicemail with real-time transcripts of voicemails, personalised personal contact “posters,” and video voicemails for FaceTime are all part of the update. Search filters, a catch-up arrow, live location sharing, and a safety feature called Check-In are all available in Messages. AirDrop now supports NameDrop for transferring contact information; stickers have been expanded. The autocorrect and recording features on the keyboard have been improved for accuracy. Standby in the lock screen is an intelligent home display that shows the weather, upcoming appointments, and notifications. Siri works on Standby and adjusts itself for the night. The developer beta is currently available now, and a public beta will take place next month before the full release is in the fall.

Vision Pro VR Headset

Apple unveiled the Vision Pro AR headset, their first foray into virtual reality (VR), during the WWDC keynote. The Vision Pro is a virtual reality headset that competes with PlayStation VR2 and Meta Quest 3. This is in contrast to the long-awaited Apple smart glasses. Apple put a lot of effort into making a thin and light headset by using premium materials when needed. Voice, hand, and eye commands are all used to operate the Digital Crown-equipped device. The showcases offer extraordinary clarity, which is fueled by Apple’s M2 processor with a committed R1 chip. The Vision Pro combines virtual reality (VR) and augmented reality (AR), enabling users to interact with Apple apps and gain access to the company’s existing ecosystem. The expanded reality space created by the headset’s sensors and cameras allows users to place apps in real-world environments and adjust their level of concentration. Optic ID is a security and unlocking eye-tracking technology that is incorporated into the Vision Pro. It allows for a more immersive screen experience because it is compatible with Apple accessories like Magic Keyboard and Mac. At launch, the Vision Pro supports over a hundred Apple game galleries. Disney gave a hint that Apple and Disney might work together in the future by announcing support for the Vision Pro and making the Disney Plus app available immediately. The show highlighted the headset’s lightweight plan and recommended Apple clients wear it for extended periods. However, widespread adoption may be difficult due to the high price of $3,499 (₹289,093.01 approx). Apple is expected to release the Vision Pro for public use in 2024.

15-inch MacBook Air

At the WWDC event, Apple revealed a new MacBook Air with a larger 15-inch model instead of the standard 13-inch model. The 15-inch MacBook Air features a powerful Apple M2 processor, a thin, light, and long-lasting design, and a stunning 15.3-inch Retina display. It comes in four colours and has a headphone jack, two USB-C ports, and MagSafe charging. The display has six spatial speakers, a 1080p webcam, and 500 nits of brightness. Apple claims a battery life of up to 18 hours.

Conclusion

At Apple’s 2023 WWDC, the company demonstrated its commitment to developing technology that is user-friendly and accessible to all. Apple’s commitment to improving the user experience across all of its products is demonstrated in the updates to operating systems, improvements of Siri, breakthroughs in augmented reality, and enhancements to health and fitness.By making complex innovations more like-minded and easy to understand, Apple is enabling people to use the maximum capacity of their gadgets. Apple’s innovations at WWDC 2023 are expected to shape the future of technology, simplifying everyday tasks and revolutionising how we interact with the digital world.As we push ahead, it is exciting to guess what these advancements will proceed to develop and decidedly mean for our lives. The future holds even more incredible possibilities for all of us because of Apple’s focus on privacy, user-centric design, and pushing the boundaries of innovation. Thus, prepare to embrace a future where innovation flawlessly incorporates into our lives because of the endeavours displayed at Apple WWDC 2023.

Exclusive Training Kits Boost Esports Players

Factors Shaping Esports in India: The Indian Esports world is thriving & growing day by day. Let’s dive in and take a look at what is shaping this culture.

May 25, 2023

Introduction

In recent years, India has witnessed a significant rise in the popularity and recognition of esports, which refers to online gaming. Esports has emerged as a mainstream phenomenon, influencing players and youngsters worldwide. In India, with the penetration of the internet at 52%, the youth has got its attracted to Esports. In this blog post, we will look at how the government is booting the players, establishing professional leagues, and supporting gaming companies and sponsors in the best possible manner. As the ecosystem continues to rise in prominence and establish itself as a mainstream sporting phenomenon in India.

Factors Shaping Esports in India: A few factors are shaping and growing the love for esports in India here. Let’s have a look.

Technological Advances: The availability and affordability of high-speed internet connections and smart gaming equipment have played an important part in making esports more accessible to a broader audience in India. With the development of smartphones and low-cost gaming PCs, many people may now easily participate in and watch esports tournaments.

Youth Demographic: India has a large population of young people who are enthusiastic gamers and tech-savvy. The youth demographic’s enthusiasm for gaming has spurred the expansion of esports in the country, as they actively participate in competitive gaming and watch major esports competitions.

Increase in the Gaming community: Gaming has been deeply established in Indian society, with many people using it for enjoyment and social contact. As the competitive component of gaming, esports has naturally gained popularity among gamers looking for a more competitive and immersive experience.

Esports Infrastructure and Events: The creation of specialised esports infrastructure, such as esports arenas, gaming cafés, and tournament venues, has considerably aided esports growth in India. Major national and international esports competitions and leagues have also been staged in India, offering exposure and possibilities for prospective esports players. Also supports various platforms such as YouTube, Twitch, and Facebook gaming, which has played a vital role in showcasing and popularising Esports in India.

Government support: Corporate and government sectors in India have recognised the potential of esports and are actively supporting its growth. Major corporate investments, sponsorships, and collaborations with esports organisations have supplied the financial backing and resources required for the country’s esports development. Government attempts to promote esports have also been initiated, such as forming esports governing organisations and including esports in official sporting events.

Growing Popularity and Recognition: Esports in India has witnessed a significant surge in viewership and fanbase, all thanks to online streaming platforms such as Twitch, YouTube which have provided a convenient way for fans to watch live esports events at home and at high-definition quality social media platforms let the fans to interact with their favourite players and stay updated on the latest esports news and events.

Esports Leagues in India

The organisation of esports tournaments and leagues in India has increased, with the IGL being one of the largest and most popular. The ESL India Premiership is a major esports event the Electronic Sports League organised in collaboration with NODWIN Gaming. Viacom18, a well-known Indian media business, established UCypher, an esports league. It focuses on a range of gaming games such as CS: GO, Dota 2, and Tekken in order to promote esports as a professional sport in India. All of these platforms provide professional players with a venue to compete and establish their profile in the esports industry.

India’s Performance in Esports to Date

Indian esports players have achieved remarkable global success, including outstanding results in prominent events and leagues. Individual Indian esports players’ success stories illustrate their talent, determination, and India’s ability to flourish in the esports sphere. These accomplishments contribute to the worldwide esports landscape’s awareness and growth of Indian esports. To add the name of the players and their success stories that have bought pride to India, they are Tirth Metha, Known as “Ritr”, a CS:GO player, Abhijeet “Ghatak”, Ankit “V3nom”, Saloni “Meow16K”.Apart from this Indian women’s team has also done exceptionally well in CS:GO and has made it to the finale.

Government and Corporate Sectors support: The Indian esports business has received backing from the government and corporate sectors, contributing to its growth and acceptance as a genuine sport.

Government Initiatives: The Indian government has expressed increased support for esports through different initiatives. This involves recognising esports as an official sport, establishing esports regulating organisations, and incorporating esports into national sports federations. The government has also announced steps to give financial assistance, subsidies, and infrastructure development for esports, therefore providing a favourable environment for the industry’s growth. Recently, Kalyan Chaubey, joint secretary and acting CEO of the IOA, personally gave the athletes cutting-edge training gear during this occasion, providing kits to the players. The kit includes the following:

Advanced gaming mouse.

Keyboard built for quick responses.

A smooth mousepad

A headphone for crystal-clear communication

An eSports bag to carry the equipment.

Corporate Sponsorship and Partnerships

Indian corporations have recognised esports’ promise and actively sponsored and collaborated with esports organisations, tournaments, and individual players. Companies from various industries, including technology, telecommunications, and entertainment, have invested in esports to capitalise on its success and connect with the esports community. These sponsorships and collaborations give financial support, resources, and visibility to esports in India. The leagues and championships provide opportunities for young players to showcase their talent.

Challenges and future

While esports provides great job opportunities, several obstacles must be overcome in order for the industry to expand and gain recognition:

Infrastructure & Training Facilities: Ensuring the availability of high-quality training facilities and infrastructure is critical for developing talent and allowing players to realise their maximum potential. Continued investment in esports venues, training facilities, and academies is critical for the industry’s long-term success.

Fostering a culture of skill development and giving outlets for formal education in esports would improve the professionalism and competitiveness of Indian esports players. Collaborations between educational institutions and esports organisations can result in the development of specialised programs in areas such as game analysis, team management, and sports psychology.

Establishing a thorough legal framework and governance structure for esports will help it gain legitimacy as a professional sport. Clear standards on player contracts, player rights, anti-doping procedures, and fair competition policies are all part of this.

Conclusion

Esports in India provide massive professional opportunities and growth possibilities for aspiring esports athletes. The sector’s prospects are based on overcoming infrastructure, perception, talent development, and regulatory barriers. Esports may establish itself as a viable and acceptable career alternative in India with continued support, investment, and stakeholder collaboration

How Safe Is BharOS? What Do Cybersecurity Experts Say? You Are About To Find Out

Is this 'Made in India' Mobile OS Truly Secure? Cybersecurity Experts Share Insights on BharOS.

February 11, 2023

BharOS’s successful testing grabbed massive online attention after Ashwini Vaishnaw, Minister of Communications and Electronics & IT, and Union Education Minister Dharmendra Pradhan unveiled the new mobile operating system. On Data Privacy Day, January 28, it’s appropriate to discuss the safety factors.

The OS is developed by JandKops, which has been incubated by IIT Madras Pravartak Technologies Foundation. It is claimed that BharOS will ensure the prevention of the “execution of any malware” and “execution of any malicious application”.

Even though it is called a Made in India OS, there are many people who disagree with this. It is because the OS is based on an AOSP (Android Open Source Project). It includes similar methodologies, functionalities, and basics used in Google Android.

Global safety factor

Security and data safety has been worldwide issue. A few years ago, Alphabet CEO Sundar Pichai also testified in front of US Congress while facing questions related to privacy, data collection, and location tracking.

While experts say that Android’s app ecosystem is a privacy and security disaster, a study that examined 82,501 apps pre-installed on 1,742 Android smartphones sold by 214 vendors concluded that users are woefully unaware of the significant security and privacy risks posed by pre-installed applications.

Even Apple, which takes cybersafety issues as a top priority, sometimes finds itself in a vulnerable situation. For example, last year Apple users were advised to update their devices to protect against a pair of security flaws that could allow attackers to take complete control.

It was said that one of the software flaws affected the kernel, the deepest layer of the OS shared by all Apple devices, while the other had an impact on WebKit, the technology that powers the Safari web browser.

Security researchers, including NordVPN, said that Apple’s closed development OS makes it more difficult for hackers to develop exploits, while Android raises the threat level since anyone can see its source code to develop exploits.

BharOS is not like iOS but it is kind of similar to Android and based on AOSP. So the question is, how safe would this OS be?

‘Security blanket’

Sandip Kumar Panda, Co-founder and CEO of InstaSafe, told News18: “BharOS acts as a security blanket for devices. The framework is designed in a manner that it prevents the execution of any malicious app and verifies each app on the devices before making it live on the BharOS platform.”

There are no apps without any vulnerabilities, he said. “As the app development progresses, vulnerabilities get introduced either in the form of insecure coding practices or third-party software vulnerabilities integrated with the platform. Since several Android vulnerabilities were discovered over the years, all those bugs would have been fixed now and updates would already have been for AOSP, which will be much more mature now,” he added.

Vineet Kumar, Founder and President of CyberPeace Foundation, believes that “the use of AOSP as the foundation for BharOS is a positive step” as it is a robust platform.

But according to him, it is important to note that no OS can be completely immune to all forms of cyber threats. “The key to staying safe online is to stay vigilant, use security software, keep your software updated, and be mindful of the apps you install and the websites you visit,” he said,

Furthermore, the expert stated that it is possible to make an OS more secure by implementing a variety of security features and technologies such as sandboxing, whitelisting, and application control, as well as rigorous testing and code review processes.

Kumar said: “It would be important for an independent, reputable security firm to evaluate BharOS and test its security features before it can be stated with certainty that it is more secure than other OSs.”

It is difficult to say whether the BharOS will be free of cybersecurity issues without more information about the specific features and security measures that have been implemented, he noted while adding that this OS has to go through a rigorous testing and certification process.

“It will be important to see how it measures up against established security standards and how well it can withstand real-world attacks,” the expert stated.

‍

Reference Link : https://www.news18.com/amp/news/tech/data-privacy-day-how-safe-is-bharos-what-do-cybersecurity-experts-say-you-are-about-to-find-out-6932521.html

iOS vs. Android - 2023

UI, app selection, performance, security - who does it better? Android or iOS? Learn more about what these tech giants have to offer in today's landscape.

January 30, 2023

Introduction

The world has been surfing the wave of technological advancements and innovations for the past decade, and it all pins down to one device – our mobile phone. For all mobile users, the primary choices of operating systems are Android and iOS. Android is an OS created by google in 2008 and is supported by most brands like – One+, Mi, OPPO, VIVO, Motorola, and many more and is one of the most used operating systems. iOS is an OS that was developed by Apple and was introduced in their first phone – The iPhone, in 2007. Both OS came into existence when mobile phone penetration was slow globally, and so the scope of expansion and advancements was always in favor of such operating systems.

The Evolution

iOS

Ever since the advent of the iPhone, iOS has seen many changes since 2007. The current version of iOs is iOS 16. However, in the course of creating new iOS and updating the old ones, Apple has come out with various advancements like the App Store, Touch ID & Face ID, Apple Music, Podcasts, Augmented reality, Contact exposure, and many more, which have later become part of features of Android phone as well. Apple is one of the oldest tech and gadget developers in the world, most of the devices manufactured by Apple have received global recognition, and hence Apple enjoys providing services to a huge global user base.

Android

The OS has been famous for using the software version names on the food items like – Pie, Oreo, Nougat, KitKat, Eclairs, etc. From Android 10 onwards, the new versions were demoted by number. The most recent Android OS is Android 13; this OS is known for its practicality and flexibility. In 2012 Android became the most popular operating system for mobile devices, surpassing Apple’s iOS, and as of 2020, about 75 percent of mobile devices run Android.

Android vs. iOS

1. USER INTERFACE

One of the most noticeable differences between Android and iPhone is their user interface. Android devices have a more customizable interface, with options to change the home screen, app icons, and overall theme. The iPhone, on the other hand, has a more uniform interface with less room for customization. Android allows users to customize their home screen by adding widgets and changing the layout of their app icons. This can be useful for people who want quick access to certain functions or information on their home screen. IOS does not have this feature, but it does allow users to organize their app icons into folders for easier navigation.

2. APP SELECTION

Another factor to consider when choosing between Android and iOS is the app selection. Both platforms have a wide range of apps available, but there are some differences to consider. Android has a larger selection of apps overall, including a larger selection of free apps. However, some popular apps, such as certain music streaming apps and games, may be released first or only available on iPhone. iOS also has a more curated app store, meaning that all apps must go through a review process before being accepted for download. This can result in a higher quality of apps overall, but it can also mean that it takes longer for new apps to become available on the platform. iPhone devices tend to have less processing power and RAM. But they are generally more efficient in their use of resources. This can result in longer battery life, but it may also mean that iPhones are slower at handling multiple tasks or running resource-intensive apps.

3. PERFORMANCE

When it comes to performance, both Android and iPhone have their own strengths and weaknesses. Android devices tend to have more processing power and RAM. This can make them faster and more capable of handling multiple tasks simultaneously. However, this can also lead to Android devices having shorter battery life compared to iPhones.

4. SECURITY

Security is an important consideration for any smartphone user, and Android and iPhone have their own measures to protect user data. Android devices are generally seen as being less secure than iPhones due to their open nature. Android allows users to install apps from sources other than the Google Play Store, which can increase the risk of downloading malicious apps. However, Android has made improvements in recent years to address this issue. Including the introduction of Google Play Protect, which scans apps for malware before they are downloaded. On the other hand, iPhone devices have a more closed ecosystem, with all apps required to go through Apple‘s review process before being available for download. This helps reduce the risk of downloading malicious apps, but it can also limit the platform’s flexibility.

Conclusion

The debate about the better OS has been going on for some time now, and it looks like it will get more comprehensive in the times to come, as netizens go deeper into cyberspace, they will get more aware and critical of their uses and demands, which will allow them to opt for the best OS for their convenience. Although the Andriod OS, due to its integration, stands more vulnerable to security threats as compared to iOS, no software is secure in today’s time, what is secure is its use and application hence the netizen and the platforms need to increase their awareness and knowledge to safeguard themselves and the wholesome cyberspace.

No items found.

Cyber Laws and Banking Industry

With the increasing reliance on digital technologies in the banking industry, cyber threats have become a significant concern.

June 24, 2023

Introduction

With the increasing reliance on digital technologies in the banking industry, cyber threats have become a significant concern. Cyberlaw plays a crucial role in safeguarding the banking sector from cybercrimes and ensuring the security and integrity of financial systems.

The banking industry has witnessed a rapid digital transformation, enabling convenient services and greater access to financial resources. However, this digitalisation also exposes the industry to cyber threats, necessitating the formulation and implementation of effective cyber law frameworks.

Recent Trends in the Banking Industry

Digital Transformation: The banking industry has embraced digital technologies, such as mobile banking, internet banking, and financial apps, to enhance customer experience and operational efficiency.

Open Banking: The concept of open banking has gained prominence, enabling data sharing between banks and third-party service providers, which introduces new cyber risks.

How Cyber Law Helps the Banking Sector

The banking sector and cyber crime share an unspoken synergy due to the mass digitisation of banking services. Thanks to QR codes, UPI and online banking payments, India is now home to 40% of global online banking transactions. Some critical aspects of the cyber law and banking sector are as follows:

Data Protection: Cyberlaw mandates banks to implement robust data protection measures, including encryption, access controls, and regular security audits, to safeguard customer data.

Incident Response and Reporting: Cyberlaw requires banks to establish incident response plans, promptly report cyber incidents to regulatory authorities, and cooperate in investigations.

Customer Protection: Cyberlaw enforces regulations related to online banking fraud, identity theft, and unauthorised transactions, ensuring that customers are protected from cybercrimes.

Legal Framework: Cyberlaw provides a legal foundation for digitalisation in the banking sector, assuring customers that regulations protect their digital transactions and data.

Cybersecurity Training and Awareness: Cyberlaw encourages banks to conduct regular training programs and create awareness among employees and customers about cyber threats, safe digital practices, and reporting procedures.

RBI Guidelines

The RBI, as India’s central banking institution, has issued comprehensive guidelines to enhance cyber resilience in the banking industry. These guidelines address various aspects, including:

Technology Risk Management

Cyber Security Framework

IT Governance

Cyber Crisis Management Plan

Incident Reporting and Response

Recent Trends in Banking Sector Frauds and the Role of Cyber Law

Phishing Attacks: Cyberlaw helps banks combat phishing attacks by imposing penalties on perpetrators and mandating preventive measures like two-factor authentication.

Insider Threats: Cyberlaw regulations emphasise the need for stringent access controls, employee background checks, and legal consequences for insiders involved in fraudulent activities.

Ransomware Attacks: Cyberlaw frameworks assist banks in dealing with ransomware attacks by enabling legal actions against hackers and promoting preventive measures, such as regular software updates and data backups.

Master Directions on Cyber Resilience and Digital Payment Security Controls for Payment System Operators (PSOs)

Draft of Master Directions on Cyber Resilience and Digital Payment Security Controls for Payment System Operators (PSOs) issued by the Reserve Bank of India (RBI). The directions provide guidelines and requirements for PSOs to improve the safety and security of their payment systems, with a focus on cyber resilience. These guidelines for PSOs include mobile payment service providers like Paytm or digital wallet payment platforms.

Here are the highlights-

The Directions aim to improve the safety and security of payment systems operated by PSOs by providing a framework for overall information security preparedness, with an emphasis on cyber resilience.

The Directions apply to all authorised non-bank PSOs.

PSOs must ensure adherence to these Directions by unregulated entities in their digital payments ecosystem, such as payment gateways, third-party service providers, vendors, and merchants.

The PSO’s Board of Directors is responsible for ensuring adequate oversight over information security risks, including cyber risk and cyber resilience. A sub-committee of the Board may be delegated with primary oversight responsibilities.

PSOs must formulate a Board-approved Information Security (IS) policy that covers roles and responsibilities, measures to identify and manage cyber security risks, training and awareness programs, and more.

PSOs should have a distinct Board-approved Cyber Crisis Management Plan (CCMP) to detect, contain, respond, and recover from cyber threats and attacks.

A senior-level executive, such as a Chief Information Security Officer (CISO), should be responsible for implementing the IS policy and the cyber resilience framework and assessing the overall information security posture of the PSO.

PSOs need to define Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) to identify potential risk events and assess the effectiveness of security controls. The sub-committee of the Board is responsible for monitoring these indicators.

PSOs should conduct a cyber risk assessment when launching new products, services, technologies, or significant changes to existing infrastructure or processes.

PSOs, including inventory management, identity and access management, network security, application security life cycle, security testing, vendor risk management, data security, patch and change management life cycle, incident response, business continuity planning, API security, employee awareness and training, and other security measures should implement various baseline information security measures and controls.

PSOs should ensure that payment transactions involving debit to accounts conducted electronically are permitted only through multi-factor authentication, except where explicitly permitted/relaxed.

Conclusion

The relationship between cyber law and the banking industry is crucial in ensuring a secure and trusted digital environment. Recent trends indicate that cyber threats are evolving and becoming more sophisticated. Compliance with cyber law provisions and adherence to guidelines such as those provided by the RBI is essential for banks to protect themselves and their customers from cybercrimes. By embracing robust cyber law frameworks, the banking industry can foster a resilient ecosystem that enables innovation while safeguarding the interests of all stakeholders or users.

Protecting Policyholders in the Digital Age

The insurance industry is a target for cybercriminals due to the sensitive nature of the information it holds.

June 10, 2023

Introduction

The insurance industry is a target for cybercriminals due to the sensitive nature of the information it holds. This makes it essential for insurance companies to have robust cybersecurity measures to protect their data and customers’ personal information.

Cyber fraud in India’s insurance industry is increasing. It is reported that the Indian insurance sector has witnessed a surge in cyber-attacks, with several instances of data breaches, identity thefts, and financial fraud being reported. These cybercrimes not only pose a significant threat to the financial stability of the insurance industry but also to the privacy and security of policyholders.

Cyber Frauds in the Insurance Industry

The insurance industry in India has been the target of increasing cyber fraud in recent years. With the growing digital transformation trend, insurance companies have become increasingly vulnerable to cyber-attacks. Cyber frauds in the insurance industry are initiated by hackers who use various techniques such as phishing, malware, ransomware, and social engineering to gain unauthorised access to policyholders’ personal data and sensitive information

Kinds of cyber frauds in the insurance industry

It is essential for insurers and policyholders alike to be aware of these kinds of cyber-attacks on insurance companies in today’s digital age. Staying educated about these threats can help prevent them from happening in the future.

Identity theft– One common type of cyber fraud that occurs in the insurance industry is identity theft. In this type of fraud, criminals steal personal information such as name, address, date of birth and social security numbers through phishing emails or fraudulent websites. They then use this information to open fraudulent policies or access existing ones.

Payment fraud- Another type of cyber fraud that is on the rise is payment fraud. In this type of fraud, hackers intercept electronic payments made by policyholders or agents using fake bank accounts or compromised payment gateways. The money is then siphoned into untraceable accounts, making it difficult for law enforcement agencies to identify and arrest the perpetrators.

Phishing attacks- Where the fraudsters posed as company officials and sent emails to policyholders requesting their account details. The unsuspecting customers fell for this scam and shared their sensitive information, which was then used to access their accounts and steal funds.

Hacking- Where hackers breach the company’s system to gain access to policyholder data. The hackers’ stoles personal records, including names, addresses, phone numbers, social security numbers, and financial information, which they later sell on the dark web.

Fake policies scam- Fraudsters create fake policies using stolen identities and collect premiums from innocent customers. The insurer then voided these policies due to fraudulent activity leaving those people without valid coverage when they needed it most. The victims suffer significant financial losses due to this scam.

Fake Insurance Websites- Discuss the creation of deceptive websites that imitate well-known insurance companies, where unsuspecting individuals provide their personal details, leading to identity theft or financial losses.

Prevention of Cyber Frauds in the Insurance Industry- Best practices to follow

Prevention is better than cure, which also holds true in the case of cyber fraud in the insurance industry. The industry must take proactive steps to prevent such frauds from occurring in the first place. One of the most effective ways to do so is by investing in cybersecurity measures that are specifically designed for the insurance sector.

Insurance companies must conduct regular employee training programs on cybersecurity best practices. This includes educating employees on how to identify and avoid phishing emails, create strong passwords, and recognise potential cyber threats. Companies should also establish a reporting mechanism for employees to report suspicious activity or incidents immediately.

Having proper access controls in place is also necessary. This means limiting access to sensitive data only to those employees who need it, implementing two-factor authentication, and regularly monitoring user activity logs. Regular audits can also provide an extra layer of protection against potential threats by identifying vulnerabilities that may have been overlooked during routine security checks.

Another essential step is encrypting all data transmitted between different systems and devices. Encryption scrambles data into unreadable codes that can only be deciphered using a decryption key, making it difficult for hackers to intercept or steal information in transit.

Legal Framework for Cyber Frauds in the Insurance Industry

The legal framework for cyber fraud in the insurance industry is critical to preventing such crimes. The Insurance Regulatory and Development Authority of India (IRDAI) has issued guidelines for insurers to establish a cybersecurity framework. The guidelines require insurers to conduct regular risk assessments, implement security measures, and ensure compliance with data privacy laws.

The Information Technology Act 2000, is another significant piece of legislation dealing with cyber fraud in India. The act defines offences such as unauthorised access to a computer system, hacking, and tampering with data. It also provides for stringent penalties and imprisonment for those found guilty of such offences.

The IRDAI’s guidelines provide insurers with a roadmap to establish robust cybersecurity measures to help prevent cyber fraud in the insurance industry. Stringent implementation of these guidelines will go a long way in safeguarding sensitive customer information from falling into the wrong hands.

Best Practices for Insurers and Policyholders

Insurers:

Implementing Strong Authentication: Encouraging the use of multi-factor authentication and secure login processes to safeguard customer accounts and prevent unauthorised access.

Regular Employee Training: Conduct cybersecurity awareness programs to educate employees about the latest threats and preventive measures.

Investing in Advanced Technologies: Utilizing robust cybersecurity tools and systems to promptly detect and mitigate potential cyber threats.

Policyholders:

Vigilance and Awareness: Policyholders must stay vigilant while sharing personal information online and verify the authenticity of insurance websites and communication channels.

Regular Updates and Patches: Advising individuals to keep their devices and software up to date to minimise vulnerabilities that cybercriminals can exploit.

Secure Online Practices: Encouraging the use of strong and unique passwords, avoiding sharing sensitive information on unsecured networks, and exercising caution when clicking on suspicious links or attachments.

Conclusion

As the Indian insurance industry embraces digitisation, the risk of cyber scams and data breaches becomes a significant concern. Insurers and policyholders must collaborate to ensure robust cybersecurity measures are in place to protect sensitive information and financial interests.

It is essential for insurance companies to invest in robust cybersecurity measures that can detect and prevent fraud attempts. Additionally, educating employees on the dangers of cyber fraud and implementing strict compliance measures can go a long way in mitigating risks. With these efforts, the insurance industry can continue to provide trustworthy and reliable services to its customers while protecting against cyber threats. As technology continues to evolve, it is imperative that the insurance industry adapts accordingly and remains vigilant against emerging threats.

Meta slapped by EU fine over data privacy breach

This EU judgment demonstrates how government rules are upending the borderless way data has traditionally migrated.

May 30, 2023

Introduction

The European Union has fined the meta $ 1.3 billion for infringing the EU privacy laws by transferring the personal data of Facebook users to the United States. The EU fined Meta’s business in Ireland. As per the European Union, transferring Personal data to the US is a breach of the General data protection Regulation or European Union law on data protection and privacy.

GDPR Compliance

The terms of GDPR promise to gather users’ personal information legally and under strict conditions. And those who collect and manage personal data must protect users’ personal data from exploitation. The GDPR restricts an organisation’s capacity to transfer personal data outside the EU if the transfer is solely based on that body’s evaluation of the sufficiency of the personal data’s protection. Transfers should only be made where European authorities have determined that a third country, a territory within that third country, or an international organisation provides acceptable protection for data protection.

Violation by Meta

The punishment, announced by Ireland’s Data Protection Commission, might be one of the most significant in the five years since the European Union passed the landmark General Data Protection Regulation. According to regulators, Facebook failed to comply with a 2020 judgment by the European Union’s top court that Facebook data transferred over the Atlantic was not sufficiently safeguarded from American espionage agencies. However, whether Meta will ever need to encrypt Facebook users’ data in Europe is still being determined. Meta announced it would appeal the ruling, launching a potentially legal procedure.

Simultaneously, European Union and American officials are negotiating a new data-sharing pact that would provide legal protections for Meta and scores of other companies to continue moving information between the US and Europe. This pact could overturn much of the European Union’s Monday ruling.

Article 46(1) GDPR Has been violated by the meta, And as per the Irish privacy.

What is required by the GDPR before transferring personal information across national boundaries?

Personal data transfers to countries outside the European Economic Area are generally permitted if these nations are regarded to provide a sufficient degree of data protection. According to Article 45 of the GDPR, the European Commission evaluates the degree of personal data protection in third countries.

The European Union judgment demonstrates how government rules are upending the borderless way data has traditionally migrated. Companies are increasingly being pressed to store data within the country where it is acquired rather than allowing it to transfer freely to data centres around the world as a result of data-protection requirements, national security laws, and other regulations.

The US internet giant had previously warned that if forced to stop using SCCs (standard contractual clauses) without a proper alternative data transfer agreement in place, it would be compelled to shut down services such as Facebook and Instagram in Europe.

What will happen next for Facebook in Europe?

The ruling includes a six-month transition period before it must halt data flows, meaning the service will continue to operate in the meantime. (More specifically, Meta has been given a five-month transition period to freeze any future transfer of personal data to the United States and a six-month deadline to terminate the unlawful processing and/or storage of European user data it has previously transferred without a legitimate legal basis. Meta has also stated that it will appeal and appears to seek a stay of execution while it pursues its legal arguments in court.

Conclusion

The GDPR places restrictions on transferring personal data outside the European Union to third-party nations or international bodies to ensure that the GDPR’s level of protection for individuals is not jeopardised. But the meta violated the European Union’s privacy laws by the user’s personal information to the US. Under the compliance of GDPR, transferring and sending personal information to users intentionally is an offence. and presently, the personal data of Facebook users has been breached by the Meta, as they shared the information with the US.

Space Laws - Indian Perspective

Recent advances in space exploration and technology have increased the need for space laws to control the actions of governments and corporate organisations.

January 24, 2023

Introduction

Recent advances in space exploration and technology have increased the need for space laws to control the actions of governments and corporate organisations. India has been attempting to create a robust legal framework to oversee its space activities because it is a prominent player in the international space business. In this article, we’ll examine India’s current space regulations and compare them to the situation elsewhere in the world.

Space Laws in India

India started space exploration with Aryabhtta, the first satellite, and Rakesh Sharma, the first Indian astronaut, and now has a prominent presence in space as many international satellites are now launched by India. NASA and ISRO work closely on various projects

India currently lacks any space-related legislation. Only a few laws and regulations, such as the Indian Space Research Organisation (ISRO) Act of 1969 and the National Remote Sensing Centre (NRSC) Guidelines of 2011, regulate space-related operations. However, more than these rules and regulations are essential to control India’s expanding space sector. India is starting to gain traction as a prospective player in the global commercial space sector. Authorisation, contracts, dispute resolution, licencing, data processing and distribution related to earth observation services, certification of space technology, insurance, legal difficulties related to launch services, and stamp duty are just a few of the topics that need to be discussed. The necessary statute and laws need to be updated to incorporate space law-related matters into domestic laws.

India’s Space Presence

Space research activities were initiated in India during the early 1960s when satellite applications were in experimental stages, even in the United States. With the live transmission of the Tokyo Olympic Games across the Pacific by the American Satellite ‘Syncom-3’ demonstrating the power of communication satellites, Dr Vikram Sarabhai, the founding father of the Indian space programme, quickly recognised the benefits of space technologies for India.

As a first step, the Department of Atomic Energy formed the INCOSPAR (Indian National Committee for Space Research) under the leadership of Dr Sarabhai and Dr Ramanathan in 1962. The Indian Space Research Organisation (ISRO) was formed on August 15, 1969. The prime objective of ISRO is to develop space technology and its application to various national needs. It is one of the six largest space agencies in the world. The Department of Space (DOS) and the Space Commission were set up in 1972, and ISRO was brought under DOS on June 1, 1972.

Since its inception, the Indian space programme has been orchestrated well. It has three distinct elements: satellites for communication and remote sensing, the space transportation system and application programmes. Two major operational systems have been established – the Indian National Satellite (INSAT) for telecommunication, television broadcasting, and meteorological services and the Indian Remote Sensing Satellite (IRS) for monitoring and managing natural resources and Disaster Management Support.

Global Scenario

The global space race has been on and ever since the moon landing in 1969, and it has now transformed into the new cold war among developed and developing nations. The interests and assets of a nation in space need to be safeguarded by the help of effective and efficient policies and internationally ratified laws. All nations with a presence in space do not believe in good for all policy, thus, preventive measures need to be incorporated into the legal system. A thorough legal framework for space activities is being developed by the United Nations Office for Outer Space Affairs (UNOOSA). The “Outer Space Treaty,” a collection of five international agreements on space law, establishes the foundation of international space law. The agreements address topics such as the peaceful use of space, preventing space from becoming militarised, and who is responsible for damage caused by space objects. Well-established space laws govern both the United States and the United Kingdom. The National Aeronautics and Space Act, which was passed in the US in 1958 and established the National Aeronautics and Space Administration (NASA) to oversee national space programmes, is in place there. The Outer Space Act of 1986 governs how UK citizens and businesses can engage in space activity.

Conclusion

India must create a thorough legal system to govern its space endeavours. In the space sector, there needs to be a legal framework to avoid ambiguity and confusion, which may have detrimental effects. The Pacific use of space for the benefit of humanity should be covered by domestic space legislation in India. The overall scenario demonstrates the requirement for a clearly defined legal framework for the international acknowledgement of a nation’s space activities. India is fifth in the world for space technology, which is an impressive accomplishment, and a strong legal system will help India maintain its place in the space business.

Google Fined Crores by Indian Supreme Court

Why Google's Android practices led to a Rs. 1,337.76 crore penalty in India's Supreme Court. Read on to learn more about the case here.

January 23, 2023

Pretext

On 20th October 2022, the Competition Commission of India (CCI) imposed a penalty of Rs. 1,337.76 crores on Google for abusing its dominant position in multiple markets in the Android Mobile device ecosystem, apart from issuing cease and desist orders. The CCI also directed Google to modify its conduct within a defined timeline. Smart mobile devices need an operating system (OS) to run applications (apps) and programs. Android is one such mobile operating system that Google acquired in 2005. In the instant matter, the CCI examined various practices of Google w.r.t. licensing of this Android mobile operating system and various proprietary mobile applications of Google (e.g., Play Store, Google Search, Google Chrome, YouTube, etc.).

The Issue

Google was found to be misusing its dominant position in the tech market, and the same was the reason behind the penalty. Google argued about the competitive constraints being faced from Apple. In relation to understanding the extent of competition between Google’s Android ecosystem and Apple’s iOS ecosystem, the CCI noted the differences in the two business models, which affect the underlying incentives of business decisions. Apple’s business is primarily based on a vertically integrated smart device ecosystem that focuses on the sale of high-end smart devices with state-of-the-art software components. In contrast, Google’s business was found to be driven by the ultimate intent of increasing users on its platforms so that they interact with its revenue-earning service, i.e., online searches, which directly affects the sale of online advertising services by Google. It was seen that google had created a dominant position among the android phone manufacturers as they were made to have a set of google apps preinstalled in the device to increase the user’s dependency on google services. The CCI felt that Google had created a dominant position to which they replied that the same operations are done by Apple as well, to which the commission responded that apple is a phone and app manufacturer and they have Apple-owned apps in Apple devices only, but Google here in had made a pseudo mandate for android manufactures to have the google apps pre-installed which is, in turn, a possible way of disrupting the market equilibrium and violative of market practices. The CCI imposed a penalty of Rs. 1,337.76 for abusing its dominant position in multiple markets in India, CCI delineated the following five relevant markets in the present matter –

The market for licensable OS for smart mobile devices in India
The market for app store for Android smart mobile OS in India
The market for general web search services in India
The market for non-OS specific mobile web browsers in India
The market for online video hosting platforms (OVHP) in India.

Supreme Courts Opinion

In October 2022, the Competition Commission of India (CCI) ruled that Google, owned by Alphabet Inc, exploited its dominant position in Android and told it to remove restrictions on device makers, including those related to the pre-installation of apps and ensuring exclusivity of its search. Google lost a challenge in the Supreme Court to block the directives, as the learned court refused to put a stay on the imposed penalty, further giving seven days to comply. The Supreme Court has said a lower tribunal—where Google first challenged the Android directives—can continue to hear the company’s appeal and must rule by March 31.

Counterpoint Research estimates that about 97% of 600 million smartphones in India run on Android. Apple has just a 3% share. Hoping to block the implementation of the CCI directives, Google challenged the CCI order in the Supreme Court by warning it could stall the growth of the Android ecosystem. It also said it would be forced to alter arrangements with more than 1,100 device manufacturers and thousands of app developers if the directives kick in. Google has been concerned about India’s decision as the steps are seen as more sweeping than those imposed in the European Commission’s 2018 ruling. There it was fined for putting in place what the Commission called unlawful restrictions on Android mobile device makers. Google is still challenging the record $4.3 billion fine in that case. In Europe, Google made changes later, including letting Android device users pick their default search engine, and said device makers would be able to license the Google mobile application suite separately from the Google Search App or the Chrome browser.

‍

Conclusion

As the world goes deeper into cyberspace, the big tech companies have more control over the industry and the markets, but the same should not turn into anarchy in the global markets. The Tech giants need to be made aware that compliance is the utmost duty for all companies, and enforcement of the law of the land will be maintained no matter what. Earlier India lacked policies and legislation to govern cyberspace, but in the recent proactive stance by the govt, a lot of new bills have been tabled, one of them being the Intermediary Rules 2021, which has laid down the obligations nand duties of the companies by setting up an intermediary in the country. Such bills coupled with such crucial judgments on tech giants will act as a test and barrier for other tech companies who try to flaunt the rules and avoid compliance.

What are Wi-Fi Attacks | Ethical Hacking

Learn about Wi-Fi attacks and how to protect your network from hackers. Discover the risks of unsecured Wi-Fi and the advantages of Li-Fi technology.

December 8, 2022

What are Wi-Fi attacks?

Wi-fi is an important area of cyber security and there is no need for physical cable for the network. Wi-Fi has access to a network signal radius everywhere. The devices and systems can have a network without physical access due to Wi-fi. But everything comes with cons and pros, and if we talk about cybersecurity, it has been established that Wi-fi networks are extremely vulnerable to security breaches and it is very easy to be hacked by hackers. Wi-Fi can be accessed by almost every device in the modern day: it can be smartphones, tablets, computers, and laptops. To know whether someone has been tampering with your personal Wi-Fi there are certain signs that can prove it. The first and most important sign is that your internet speed gets slower, as someone else is using your Wi-Fi surf.

Why would anyone hack someone’s Wi-Fi network?

Usually, hackers hack the network because they want access to the confidential data of someone and they can observe all the online activities and data that have been sent through a network. An unauthorize hacker will pretty much be able to see everything you do online. Wi-Fi allows hackers o view information on sites. Any financial information which is saved in the browser can be accessed by hackers and they can alter it and can alter the content you see online. And all the information saved in Wi-fi networks can be used by hackers for their own benefit, they can sell it, impersonate you, or even take money out of your bank through Wi-Fi.

Avoiding vulnerable Wi-Fi networks

The first and foremost rule of protection is that you should not use public networks if that network is easily open to you then that is also available to others and from others, and someone can who wishes to use your confidential and sensitive information, can access that. If you really need to access the public network in an urgent situation, then you must make sure to limit your activities while connected. And avoid accessing your online banking or pages that require login information. Also, a good measure to take as well is to always delete your cookies after using public WIFI.

How To Secure Your Home Wi-Fi Network

Your home’s wireless internet connection is your Wi-Fi network. Typically, a wireless router is used, which broadcasts a signal into the atmosphere. You can connect to the internet using that signal. However, if your network is not password-protected, any nearby device can grab the signal off the air and connect to your internet. The benefit of Wi-Fi? Wireless access to the internet is possible. The negative? Your internet activity, including your personal information, may be visible to neighboring users who connect to your unprotected network. Furthermore, if someone uses your network to conduct a crime or send out unauthorized spam, you might be held accountable.

Wi-Fi or Li-Fi? –

The common consensus is that Li-Fi technology is more secure than Wi-Fi. Li-Fi systems can be made more secure by integrating a variety of security features. Although these qualities might appear when Li-Fi is widely used in the near future, it is already thought to be safer because of a number of security features. Since the connection’s characteristics make it simpler to lock connections, limit access, and track users even in the absence of encryption and other security features, Li-Fi is seen as being safer. Li-Fi systems will be able to support new security protocols, which will not only enable high-speed networking but also open the door for innovative security techniques to strengthen connections.

Conclusion

A hacker can sniff the network packets without having to be in the same building where the network is located. As wireless networks communicate through radio waves, a hacker can easily sniff the network from a nearby location. Most attackers use network sniffing to find the SSID and hack a wireless network.

Any wireless network can theoretically be attacked in a number of different ways. Use of the default SSID or password, WPS pin authentication, insufficient access control, and leaving the access point available in open locations are all examples of potential vulnerabilities that could allow for the theft of sensitive data. Kismet’s architecture in WIDS mode may guard against DOS, MiTM, and MAC spoofing attacks. routine software updates on the other hand, the use of firewalls may help defend the network against outside intrusion. The act of finding infrastructure issues that could allow harmful code to be injected into a service, system, or organization is known as ethical hacking. They use this technique to prevent invasions by lawfully breaking into networks and looking for weak spots.

Google Play Enhancing Trust and Transparency

Google Play introduces a new policy for developer verification with D-U-N-S numbers and enhanced app details to build user trust and transparency.

July 28, 2023

Introduction

Google Play has announced its new policy which will ensure trust and transparency on google play by providing a new framework for developer verification and app details. The new policy requires that new developer accounts on Google Play will have to provide a D-U-N-S number to verify the business. So when an organisation will create a new Play Console developer account the organisation will need to provide a D-U-N-S number. Which is a nine-digit unique identifier which will be used to verify their business. The new google play policy aims to enhance user trust. And the developer will provide detailed developer details on the app’s listing page. Users will get to know who is behind the app which they are installing.

Verifying Developer Identity with D-U-N-S Numbers

To boost security the google play new policy requires the developer account to provide the D-U-N-S number when creating a new Play Console developer account. The D-U-N-S number assigned by Dun & Bradstreet will be used to verify the business. Once the developer creates his new Play Console developer account by providing a D-U-N-S number, Google Play will verify the developer’s details, and he will be able to start publishing the apps. Through this step, Google Play aims to validate the business information in a more authentic way.

If your organisation does not have a D-U-N-S number, you may check on or request for it for free on this website (https://www.dnb.com/duns-number/lookup.html). The request process for D-U-N-S can take up to 30 days. Developers are also required to keep the information up to date.

‍Building User Trust with Enhanced App Details

In addition to verifying developer identities in a more efficient way, google play also requires that developer provides sufficient app details to the users. There will be an “App Support” section on the app’s store listing page, where the developer will display the app’s support email address and even can include their website and phone number for support.

The new section “About the developer” will also be introduced to provide users with verified identity information, including the developer’s name, address, and contact details. Which will make the users more informed about the valuable information of the app developers.

Key highlights of the Google Play Polic

Google Play came up with the policy to keep the platform safe by verifying the developers’ identity and it will also help to reduce the spread of malware apps and help the users to make confident informed decisions about the apps they download. Google Play announced the policy by expanding its developer verification requirement to strengthen Google Play as a platform and build user trust. When you create a new Play Console Developer account and choose organisation as your account type you will now need to provide a D-U-N-S number.
Users will get detailed information about the developers’ identities and contact information, building more transparency and encouraging responsible app development practices.
This policy will enable the users to make informed choices about the apps they download.
The new “App support” section will provide enhanced communication between users and developers by displaying support email addresses, website and support phone numbers, streamlining the support process and user satisfaction.

Timeline and Implementation

The new policy requirements for D-U-N-S numbers will start rolling out on 31 August 2023 for all new Play Console developer accounts. The “About the developer” section will be visible to users as soon as a new app is published. and In October 2023, existing developers will also be required to update and verify their existing accounts to comply with the new verification policy.

Conclusion

Google Play’s new policy will aim to enhance the more transparent app ecosystem. This new policy will provide the users with more information about the developers. Google Play aims to establish a platform where users can confidently discover and download apps. This new policy will enhance the user experience on google play in terms of a reliable and trustworthy platform.

TRAI’s Consultation Paper on OTT Platforms

Explore the Telecom Regulatory Authority of India's Consultation Paper on Regulatory Mechanisms for Over-The-Top (OTT) Communication Services.

July 9, 2023

Introduction

Recently, a Consultation Paper on Regulatory Mechanisms for Over-The-Top (OTT) Communication Services was published by the Telecom Regulatory Authority of India (TRAI). The paper explores several OTT regulation-related challenges and solicits input from stakeholders on a suggested regulatory framework. We’ll summarise the paper’s main conclusions in this blog.

Structure of the Paper

The Telecom Regulatory Authority of India’s Consultation Paper on Regulatory Mechanism for Over-The-Top (OTT) Communication Services and Selective Banning of OTT Services intends to solicit comments and recommendations from stakeholders about the regulation of OTT services in India. The paper is broken up into five chapters that cover the introduction and background, issues with regulatory mechanisms for OTT communication services, issues with the selective banning of OTT services, a summary of the issues for consultation, and an overview of international practices on the topic. Written comments from interested parties are requested and may be sent electronically to the Advisor (Networks, Spectrum and Licencing) at TRAI. These comments will also be posted on the TRAI website.

Overview of the Paper

Chapter 1: Introduction and Background

The first chapter of the essay introduces the subject of OTT communication services and argues why regulatory frameworks are necessary. The chapter also gives a general outline of the topics and the paper’s organisation that will be covered in the following chapters.

Chapter 2: Examination of the Issues Related to Regulatory Mechanism for Over-The-Top Communication Services

The second chapter of the essay looks at the problems with OTT communication service regulation. It talks about the many kinds of OTT services and how they affect the conventional telecom sector. The chapter also looks at the regulatory issues raised by OTT services and the various strategies used by various nations to address them.

Chapter 3: Examination of the Issues Related to Selective Banning of OTT Services

The final chapter of the essay looks at the problems of selectively outlawing OTT services. It analyses the justifications for government restrictions on OTT services as well as the possible effects of such restrictions on consumers and the telecom sector. The chapter also looks at the legal and regulatory structures that determine how OTT services are prohibited in various nations.

Chapter 4: International Practices

An overview of global OTT communication service best practices is given in the paper’s fourth chapter. It talks about the various regulatory strategies used by nations throughout the world and how they affect consumers and the telecom sector. The chapter also looks at the difficulties regulators encounter when trying to create efficient regulatory frameworks for OTT services.

Chapter 5: Issues for Consultation

This chapter is the spirit of the consultation paper as it covers the points and questions for consultation. This chapter has been classified into two sub-sections – Issues Related to Regulatory Mechanisms for OTT Communication Services and Issues Related to the Selective Banning of OTT Services. The inputs will be entirely focused on these sub headers, and the scope, extent, and ambit of the consultation paper rests on these questions and necessary inputs.

Conclusion

An important publication that aims to address the regulatory issues raised by OTT services is the Consultation Paper on Regulatory Mechanisms for Over-The-Top Communication Services. The paper offers a thorough analysis of the problems with OTT service regulation and requests input from stakeholders on the suggested regulatory structure. In order to make sure that the regulatory framework is efficient and advantageous for everyone, it is crucial for all stakeholders to offer their opinion on the document.

Twitter on Legal CrossRoads

Twitter's appeal against the Ministry of Electronics and Information Technology's account-blocking orders has been denied by the Karnataka High Court.

July 3, 2023

Introduction

Twitter Inc.’s appeal against barring orders for specific accounts issued by the Ministry of Electronics and Information Technology was denied by a single judge on the Karnataka High Court. Twitter Inc. was also given an Rs. 50 lakh fine by Justice Krishna Dixit, who claimed the social media corporation had approached the court defying government directives.

As a foreign corporation, Twitter’s locus standi had been called into doubt by the government, which said they were ineligible to apply Articles 19 and 21 to their situation. Additionally, the government claimed that because Twitter was only designed to serve as an intermediary, there was no “jural relationship” between Twitter and its users.

The Issue

In accordance with Section 69A of the Information Technology Act, the Ministry issued the directives. Nevertheless, Twitter had argued in its appeal that the orders “fall foul of Section 69A both substantially and procedurally.” Twitter argued that in accordance with 69A, account holders were to be notified before having their tweets and accounts deleted. However, the Ministry failed to provide these account holders with any notices.

On June 4, 2022, and again on June 6, 2022, the government sent letters to Twitter’s compliance officer requesting that they come before them and provide an explanation for why the Blocking Orders were not followed and why no action should be taken against them.

Twitter replied on June 9 that the content against which it had not followed the blocking orders does not seem to be a violation of Section 69A. On June 27, 2022, the Government issued another notice stating Twitter was violating its directions. On June 29, Twitter replied, asking the Government to reconsider the direction on the basis of the doctrine of proportionality. On June 30, 2022, the Government withdrew blocking orders on ten account-level URLs but gave an additional list of 27 URLs to be blocked. On July 10, more accounts were blocked. Compiling the orders “under protest,” Twitter approached the HC with the petition challenging the orders.

Legality

Additionally, the government claimed that because Twitter was only designed to serve as an intermediary, there was no “jural relationship” between Twitter and its users.

Government attorney Additional Solicitor General R Sankaranarayanan argued that tweets mentioning “Indian Occupied Kashmir” and the survival of LTTE commander Velupillai Prabhakaran were serious enough to undermine the integrity of the nation.

Twitter, on the other hand, claimed that its users have pushed for these rights. Additionally, Twitter maintained that under Article 14 of the Constitution, even as a foreign company, they were entitled to certain rights, such as the right to equality. They also argued that the reason for the account blocking in each case was not stated and that Section 69a’s provision for blocking a URL should only apply to the offending URL rather than the entire account because blocking the entire account would prevent the creation of information while blocking the offending tweet only applied to already-created information.

Conclusion

The evolution of cyberspace has been substantiated by big tech companies like Facebook, Google, Twitter, Amazon and many more. These companies have been instrumental in leading the spectrum of emerging technologies and creating a blanket of ease and accessibility for users. Compliance with laws and policies is of utmost priority for the government, and the new bills and policies are empowering the Indian cyberspace. Non Compliance will be taken very seriously, and the same is legalised under the Intermediary Guidelines 2021 and 2022 by Meity. Referring to Section 79 of the Information Technology Act, which pertains to an exemption from liability of intermediary in some instances, it was said, “Intermediary is bound to obey the orders which the designate authority/agency which the government fixes from time to time.”

Guidelines on Information Security Practices

Learn about common online security risks and get tips to enhance your online security in this informative guide.

July 3, 2023

Introduction

Cert-In (Indian Computer Emergency Response Team) has recently issued the “Guidelines on Information Security Practices” for Government Entities for Safe & Trusted Internet. The guideline has come at a critical time when the Draft Digital India Bill is about to be released, which is aimed at revamping the legal aspects of Indian cyberspace. These guidelines lay down the policy framework and the requirements for critical infrastructure for all government organisations and institutions to improve the overall cyber security of the nation.

What is Cert-In?

A Computer Emergency Response Team (CERT) is a group of information security experts responsible for the protection against, detection of and response to an organisation’s cybersecurity incidents. A CERT may focus on resolving data breaches and denial-of-service attacks and providing alerts and incident handling guidelines. CERTs also conduct ongoing public awareness campaigns and engage in research aimed at improving security systems. The Ministry of Electronics and Information Technology (MeitY) oversees CERT-In. It regularly releases alerts to help individuals and companies safeguard their data, information, and ICT (Information and Communications Technology) infrastructure.

Indian Computer Emergency Response Team (CERT-In) has been established and appointed as national agency in respect of cyber incidents and cyber security incidents in terms of the provisions of section 70B of Information Technology (IT) Act, 2000.

CERT-In requests information from service providers, intermediaries, data centres, and body corporates to coordinate reaction actions and emergency procedures regarding cyber security incidents. It is a focal point for incident reporting and offers round-the-clock security services. It manages cyber occurrences that are tracked and reported while continuously analysing cyber risks. It strengthens the security barriers for the Indian Internet domain.

Background

India is fast becoming one of the world’s largest connected nations – with over 80 Crore Indians (Digital Nagriks) presently connected and using the Internet and cyberspace – and with this number is expected to touch 120 Crores in the coming few years. The Digital Nagriks of the country are using the Internet for business, education, finance and various applications and services including Digital Government services. Internet provides growth and innovation and at the same time it has seen rise in cybercrimes, user harm and other challenges to online safety. The policies of the Government are aimed at ensuring an Open, Safe & Trusted and Accountable Internet for its users. Government is fully cognizant and aware of the growing cyber security threats and attacks.

It is the Government of India’s objective to ensure that Digital Nagriks experience a Safe & Trusted Internet. Along with ubiquitous applications of Information & Communication Technologies (ICT) in almost all facets of service delivery and operations, continuously evolving cyber threats have become a concern for the Government. Cyber-attacks can come in the form of malware, ransomware, phishing, data breach etc., that adversely affect an organisation’s information and systems. Cyber threats leading to cyber-attacks or incidents can compromise the confidentiality, integrity, and availability of an organisation’s information and systems and can have far reaching impact on essential services and national interests. To protect against cyber threats, it is important for government entities to implement strong cybersecurity measures and follow best practices. As ICT infrastructure of the Government entities is one of the preferred targets of the malicious actors, responsibility of implementing good cyber security practices for protecting computers, servers, applications, electronic systems, networks, and data from digital attacks, also remain with the ICT assets’ owner i.e. Government entity.

What are the new Guidelines about?

The Government of India (distribution of business) Rules, 1961’s First Schedule lists a number of Ministries, Departments, Secretariats, and Offices, along with their affiliated and subordinate offices, which are all subject to the rules. They also comprise all governmental organisations, businesses operating in the public sector, and other governmental entities under their administrative control.

“The government has launched a number of steps to guarantee an accessible, trustworthy, and accountable digital environment. With a focus on capabilities, systems, human resources, and awareness, we are extending and speeding our work in the area of cyber security, according to Rajeev Chandrasekhar, Minister of State for Electronics, Information Technology, Skill Development, and Entrepreneurship.

The Recommendations

Various security domains are covered in the standards, including network security, identity and access management, application security, data security, third-party outsourcing, hardening procedures, security monitoring, incident management, and security audits.
For instance, the rules advise using only a Standard User (non-administrator) account to use computers and laptops for regular work regarding desktop, laptop, and printer security in the workplace. Users may only be granted administrative access with the CISO’s consent.
The usage of lengthy passwords containing at least eight characters that combine capital letters, tiny letters, numerals, and special characters; Never save any usernames or passwords in your web browser. Likewise, never save any payment-related data there.
They include guidelines created by the National Informatics Centre for Chief Information Security Officers (CISOs) and staff members of Central government Ministries/Departments to improve cyber security and cyber hygiene in addition to adhering to industry best practises.

Conclusion

The government has been proactive in the contemporary times to eradicate the menace of cybercrimes and therreats from the Indian cyberspace and hence now we have seen a series of new bills and polices introduced by the Ministry of Electronics and Information Technology, and various other government organisations like Cert-In and TRAI. These policies have been aimed towards being relevant to time and current technologies. The threats from emerging technologies like web 3.0 cannot be ignored and hence with active netizen participation and synergy between government and corporates will lead to a better and improved cyber ecosystem in India.

TRAI’s Consultation Paper

Discover the future of digital communication with TRAI's groundbreaking sandbox proposal.

July 1, 2023

Introduction

The Telecom Regulatory Authority of India (TRAI) issued a consultation paper titled “Encouraging Innovative Technologies, Services, Use Cases, and Business Models through Regulatory Sandbox in Digital Communication Sector. The paper presents a draft sandbox structure for live testing of new digital communication products or services in a regulated environment. TRAI seeks comments from stakeholders on several parts of the framework.

What is digital communication?

Digital communication is the use of internet tools such as email, social media messaging, and texting to communicate with other people or a specific audience. Even something as easy as viewing the content on this webpage qualifies as digital communication.

Aim of Paper

Frameworks are intended to support regulators’ desire for innovation while also ensuring economic resilience and consumer protection. Considering this, the Department of Telecom (DoT) asked TRAI to offer recommendations on a regulatory sandbox framework. TRAI approaches the issue with the goal of encouraging creativity and hastening the adoption of cutting-edge digital communications technologies.
Artificial intelligence, the Internet of Things, edge computing, and other emerging technologies are revolutionizing how we connect, communicate, and access information, driving the digital communication sector to rapidly expand. To keep up with this dynamic environment, an enabling environment for the development and deployment of novel technologies, services, use cases, and business models is required.
The regulatory sandbox concept is becoming increasingly popular around the world as a means of encouraging innovation in a range of industries. A regulatory sandbox is a regulated environment in which businesses and innovators can test their concepts, commodities, and services while operating under changing restrictions.
Regulatory Sandbox will benefit the telecom startup ecosystem by providing access to a real-time network environment and other data, allowing them to evaluate the reliability of new applications before releasing them to the market. Regulatory Sandbox also attempts to stimulate cross-sectoral collaboration for carrying out such testing by engaging the assistance of other ministries and departments in order to give the starting company with a single window for acquiring all clearances.

What is regulatory sandbox?

A regulatory sandbox is a controlled regulatory environment in which new products or services are tested in real-time.
It serves as a “safe space” for businesses because authorities may or may not allow certain relaxations for the sole purpose of testing.
The sandbox enables the regulator, innovators, financial service providers, and clients to perform field testing in order to gather evidence on the benefits and hazards of new financial innovations, while closely monitoring and mitigating their risks.

What are the advantages of having a regulatory sandbox?

Firstly, regulators obtain first-hand empirical evidence on the benefits and risks of emerging technologies and their implications, allowing them to form an informed opinion on the regulatory changes or new regulations that may be required to support useful innovation while mitigating the associated risks.
Second, sandbox customers can evaluate the viability of a product without the need for a wider and more expensive roll-out. If the product appears to have a high chance of success, it may be authorized and delivered to a wider market more quickly.

Digital communication sector and Regulatory Sandbox

Many countries’ regulatory organizations have built sandbox settings for telecom tech innovation.
These frameworks are intended to encourage regulators’ desire for innovation while also promoting economic resilience and consumer protection.
In this context, the Department of Telecom (DoT) had asked TRAI to give recommendations on a regulatory sandbox framework.
Written comments on the drafting framework will be received until July 17, 2023, and counter-comments will be taken until August 1, 2023. The Authority’s goal in the digital communication industry is to foster creativity and expedite the use of emerging technologies such as artificial intelligence (AI), the Internet of Things (IoT), and edge computing. These technologies are changing the way individuals connect, engage, and access information, causing rapid changes in the industry.

Conclusion

According to TRAI, these technologies are changing how individuals connect, engage, and obtain information, resulting in significant changes in the sector.

The regulatory sandbox also wants to stimulate cross-sectoral collaboration for carrying out such testing by engaging the assistance of other ministries and departments in order to give the starting company with a single window for acquiring all clearances. The consultation paper covers some of the worldwide regulatory sandbox frameworks in use in the digital communication industry, as well as some of the frameworks in use inside the country in other sectors.

TRAI’s New Directions

TRAI has taken several initiatives to reduce Unsolicited Commercial Communication (UCC), which is a major source of annoyance for the public.

June 20, 2023

Introduction

The Telecom Regulatory Authority of India (TRAI) has directed all telcos to set up detection systems based on Artificial Intelligence and Machine Learning (AI/ML) technologies in order to identify and control spam calls and text messages from unregistered telemarketers (UTMs).

The TRAI Directed telcos

The telecom regulator, TRAI, has directed all Access Providers to detect Unsolicited commercial communication (UCC)by systems, which is based on Artificial Intelligence and Machine Learning to detect, identify, and act against senders of Commercial Communication who are not registered in accordance with the provisions of the Telecom Commercial Communication Customer Preference Regulations, 2018 (TCCCPR-2018). Unregistered Telemarketers (UTMs) are entities that do not register with Access Providers and use 10-digit mobile numbers to send commercial communications via SMS or calls.

TRAI steps to curb Unsolicited commercial communication

TRAI has taken several initiatives to reduce Unsolicited Commercial Communication (UCC), which is a major source of annoyance for the public. It has resulted in fewer complaints filed against Registered Telemarketers (RTMs). Despite the TSPs’ efforts, UCC from Unregistered Telemarketers (UTMs) continues. Sometimes, these UTMs use messages with bogus URLs and phone numbers to trick clients into revealing crucial information, leading to financial loss.

To detect, identify, and prosecute all Unregistered Telemarketers (UTMs), the TRAI has mandated that Access Service Providers implement the UCC.

Detect the System with the necessary functionalities within the TRAI’s Telecom Commercial Communication Customer Preference Regulations, 2018 framework.

Access service providers have implemented such detection systems based on their applicability and practicality. However, because UTMs are constantly creating new strategies for sending unwanted communications, the present UCC detection systems provided by Access Service providers cannot detect such UCC.

TRAI also Directs Telecom Providers to Set Up Digital Platform for Customer Consent to Curb Promotional Calls and Messages.

Unregistered Telemarketers (UTMs) sometimes use messages with fake URLs and phone numbers to trick customers into revealing essential information, resulting in financial loss.

TRAI has urged businesses like banks, insurance companies, financial institutions, and others to re-verify their SMS content templates with telcos within two weeks. It also directed telecom companies to stop misusing commercial messaging templates within the next 45 days.

The telecom regulator has also instructed operators to limit the number of variables in a content template to three. However, if any business intends to utilise more than three variables in a content template for communicating with their users, this should be permitted only after examining the example message, as well as adequate justifications and justification.

In order to ensure consistency in UCC Detect System implementations, TRAI has directed all Access Providers to deploy UCC and detect systems based on artificial intelligence and Machine Learning that are capable of constantly evolving to deal with new signatures, patterns, and techniques used by UTMs.

Access Providers have also been directed to use the DLT platform to share intelligence with others. Access Providers have also been asked to ensure that such UCC Detect System detects senders that send unsolicited commercial communications in bulk and do not comply with the requirements. All Access Providers are directed to follow the instructions and provide an update on actions done within thirty days.

The move by TRAI is to curb the menacing calls as due to this, the number of scam cases is increasing, and now a new trend of scams started as recently, a Twitter user reported receiving an automated call from +91 96681 9555 with the message “This call is from Delhi Police.” It then asked her to stay in the queue since some of her documents needed to be picked up. Then he said he works as a sub-inspector at the Kirti Nagar police station in New Delhi. He then inquired whether she had recently misplaced her Aadhaar card, PAN card, or ATM card, to which she replied ‘no’. The scammer then poses as a cop and requests that she authenticate the last four digits of her card because they have found a card with her name on it. And a lot of other people tweeted about it.

Conclusion

TRAI directed the telcos to check the calls and messages from Unregistered numbers. This step of TRAI will curb the pesky calls and messages and catch the Frauds who are not registered with the regulation. Sometimes the unregistered sender sends fraudulent links, and through these fraudulent calls and messages, the sender tries to take the personal information of the customers, which results in financial losses.

TRAIs crackdown on pesky calls and messages

It stated that only approved online or app links, call-back numbers, and so on will be permitted to be used in consent-seeking communications.

June 17, 2023

Introduction

To combat the problem of annoying calls and SMS, telecom regulator TRAI has urged service providers to create a uniform digital platform in two months that will allow them to request, maintain, and withdraw customers’ approval for promotional calls and messages. In the initial stage, only subscribers will be able to initiate the process of registering their consent to receive promotional calls and SMS, and later, business entities will be able to contact customers to seek their consent to receive promotional messages, according to a statement issued by the Telecom Regulatory Authority of India (TRAI) on Saturday.

TRAI Directs Telecom Providers to Set Up Digital Platform

TRAI has now directed all access providers to develop and deploy the Digital Consent Acquisition (DCA) facility for creating a unified platform and process to digitally register customers’ consent across all service providers and principal entities. Consent is received and maintained under the current system by several key entities such as banks, other financial institutions, insurance firms, trading companies, business entities, real estate businesses, and so on.

The purpose, scope of consent, and the principal entity or brand name shall be clearly mentioned in the consent-seeking message sent over the short code,” according to the statement.

It stated that only approved online or app links, call-back numbers, and so on will be permitted to be used in consent-seeking communications.

TRAI issued guidelines to guarantee that all voice-based Telemarketers are brought under a single Distributed ledger technology (DLT) platform for more efficient monitoring of nuisance calls and unwanted communications. It also instructs operators to actively deploy AI/ML-based anti-phishing systems as well as to integrate tech solutions on the DLT platform to deal with malicious calls and texts.

TRAI has issued two separate Directions to Access Service Providers under TCCCPR-2018 (Telecom Commercial Communications Customer Preference Regulations) to ensure that all promotional messages are sent through Registered Telemarketers (RTMs) using approved Headers and Message Templates on Distributed Ledger Technologies (DLT) platform, and to stop misuse of Headers and Message Templates,” the regulator said in a statement.

Users can already block telemarketing calls and texts by texting 1909 from their registered mobile number. By dialing 1909, customers can opt out of getting advertising calls by activating the do not disturb (DND) feature.

Telecom providers operate DLT platforms, and businesses involved in sending bulk promotional or transactional SMS must register by providing their company information, including sender IDs and SMS templates.

According to the instructions, telecom companies will send consent-seeking messages using the common short code 127. The goal, extent of consent, and primary entity/brand name must be clearly stated in the consent-seeking message delivered via the shortcode.

TRAI stated that only whitelisted URLs/APKs (Android package kits file format)/OTT links/call back numbers, etc., shall be used in consent-seeking messages.

Telcos must “ensure that promotional messages are not transmitted by unregistered telemarketers or telemarketers using telephone numbers (10 digits numbers).” Telecom providers have been urged to act against all erring telemarketers in accordance with the applicable regulations and legal requirements.

Users can, however, refuse to receive any consent-seeking messages launched by any significant Telcos have been urged to create an SMS/IVR (interactive voice response)/online service for this purpose.

According to TRAI’s timeline, the consent-taking process by primary companies will begin on September 1.According to a nationwide survey conducted by a local circle, 66% of mobile users continue to receive three or more bothersome calls per day, the majority of which originate from personal cell numbers.

There are scams surfacing on the internet with new types of scams, like WhatsApp international call scams. The latest scam is targeting Delhi police, the scammers pretend to be police officials of Delhi and ask for the personal details of the users and the calling them from a 9-digit number.

A recent scam

A Twitter user reported receiving an automated call from +91 96681 9555, stating, “This call is from Delhi Police.” It went on to ask her to stay in the queue since some of her documents needed to be picked up. Then he said he is a sub-inspector at New Delhi’s Kirti Nagar police station. He then questioned if she had lately misplaced her Aadhaar card, PAN card, or ATM card, to which she replied ‘no’. The fraudster then claims to be a cop and asks her to validate the final four digits of her card because they have discovered a card with her name on it. And so many other people tweeted about this.

The scams are constantly increasing as earlier these scammers asked for account details and claimed to be Delhi police and used 9-digit numbers for scamming people.

TRAI’s new guidelines regarding the consent to receive any promotional calls and messages to telecommunication providers will be able to curb the scams.

The e- KYC is an essential requirement as e-KYC offers a more secure identity verification process in an increasingly digital age that uses biometric technologies to provide quick results.

Conclusion

The aim is to prevent unwanted calls and communications sent to customers via digital methods without their permission. Once this platform is implemented, an organization can only send promotional calls or messages with the customer’s explicit approval. Companies use a variety of methods to notify clients about their products, including phone calls, text messages, emails, and social media. Customers, however, are constantly assaulted with the same calls and messages as a result of this practice. With the constant increase in scams, the new guideline of TRAI will also curb the calling of Scams. digital KYC prevents SIM fraud and offers a more secure identity verification method.

New Regulations for Online Gaming

Recently some games faced a ban in India – games that involve betting, games that can be harmful to the user, and games that involve a factor of addiction.

June 17, 2023

Introduction

Online Gaming has gained popularity over the past few years, attracting young players worldwide and global concerns. In response to the growing fame of this industry, the Indian government has recently announced introducing a set of regulations to address various concerns and ensure a safer and more regulated online gaming environment. In this blog post, we will explore the critical aspects of these regulations and their impact on the gaming industry.

Why are Regulations needed?

Recently some games faced a ban in India – games that involve betting, games that can be harmful to the user, and games that involve a factor of addiction. Furthermore, with rising popularity, With the exponential rise of online gaming platforms in India, extensive laws to safeguard players and ensure fair gameplay needs to be implemented. Players’ protection is one of the critical factors addressing the issues which involve online addiction, underage involvement, fraud, and data privacy has become critical for the well-being of Indian gamers.

Regulatory Ambiguity: The previous legislative structure, such as the outmoded Public Gambling Act of 1867, required an update to fit the digital gambling age fully.

Outline of the New Regulations

Implementing new regulations for online gaming in India represents the government’s commitment to addressing different issues and ensuring a safer and more regulated gaming sector. Let’s have a look at these rules in detail:

National-Level Standards: The Indian government is currently working on creating national-level standards to standardise online gaming practices across all states. These rules attempt to create a uniform platform for both operators and participants. The government has also made an announcement to set SRO within 90 days to regulate online gaming.

Licencing and Compliance: To legally operate in the Indian market, online gaming firms must secure licences. The operator’s financial soundness, security measures, and adherence to responsible gaming practices will be scrutinised throughout the licencing process. Operators will need to comply with the regulations in order to maintain operations.

Measures to Promote Ethical Gaming: The new regulations emphasise player protection and ethical gaming practices. This includes steps like age verification to prevent underage involvement, self-exclusion choices for gamers who want to limit their gaming activities, and adopting tools like session limits and reality checks to promote responsible gaming.

Data Privacy: Recognising the importance of data privacy, the laws are intended to contain protections for protecting user data. To safeguard sensitive player information from unauthorised access or exploitation, online gambling operators must comply with data protection regulations and deploy strong security measures.

Restrictions on Advertising and Marketing: The legislation may limit the advertising and marketing of online gaming platforms. The emphasis will be on eliminating aggressive marketing tactics that target vulnerable people, such as kids. Stricter standards for ad content and placement may be implemented.

Anti-Fraud and Anti-Money Laundering Measures: To combat criminal activity within the gaming ecosystem, the new legislation will almost certainly force online gambling companies to employ anti-fraud and anti-money laundering measures. Operators may need to set up mechanisms to detect fraud, report suspicious activity, and work with law enforcement.

Consumer Grievance Redressal: The legislation may emphasise the construction of efficient channels for resolving consumer complaints. Players should be able to report difficulties, seek resolution, and offer feedback on their play experiences through channels. The objective is to create a transparent and accountable conflict resolution mechanism.

Impact on Online Gaming Ecosystem

Adopting new laws for online gambling in India will likely have several consequences for the gaming industry. Let us look at some of these consequences:

Increased Player Trust: Implementing restrictions will increase player confidence in online gaming platforms. Establishing clear rules and procedures and steps to safeguard participants’ interests will develop a sense of trust and transparency. This can lead to increased participation and engagement in the gaming community.

Industry Consolidation: Stricter restrictions may result in industry consolidation. Compliance with the new legislation would need resources and investments, which might favour more prominent and more established gambling firms. Smaller and more non-compliant operators may find it challenging to fulfil regulatory standards, resulting in a more consolidated gaming sector.

Technological Progress: The requirement to comply with rules could lead to technological advancements in the online gambling sector. Operators may invest in modern identity verification systems, fraud detection methods, and responsible gaming solutions to satisfy their regulatory requirements. This can result in technological breakthroughs that improve gamers’ overall gaming experience.

Foreign Investment and Collaboration: Clear laws might entice overseas investors to enter the Indian gaming business. The regulated environment may appeal to international gambling enterprises looking to enter or extend their presence in India. Collaborations between Indian and foreign gaming firms may also expand, resulting in the sharing of experience, resources, and the production of high-quality gaming products.

Legal Clarity: Implementing particular laws would give online gambling operators and users clearer legal standards. This transparency can eliminate ambiguity and possible legal issues, allowing stakeholders to navigate the gaming ecosystem with better confidence and knowledge.

Contribution to the Indian Economy: A well-regulated online gaming business has the potential to contribute to the Indian economy. It has the potential to create jobs, attract investment, and produce tax money for the government. The economic effect of the gaming ecosystem is expected to increase as it grows under the new restrictions.

Challenges and Future Approach

One of the toughest challenges will be the efficient implementation and enforcement of the new regulations. Consistency in applying the legislation across multiple jurisdictions and guaranteeing compliance by all operators would necessitate comprehensive monitoring and regulatory measures. Developing suitable enforcement organisations and transparent standards for reporting and dealing with noncompliance will be critical. Besides this, online gaming is open to more than area-specific and many gaming platforms and operates internationally. Ensuring cross-border operations is a big challenge in addressing jurisdictional challenges will be complex. Collaborative efforts between nations can regulate cross-border online gaming. There may be increased collaboration between Indian and foreign gaming firms, resulting in the exchange of information, skills, and resources. This partnership can help the Indian gaming sector flourish while attracting foreign players and investments.

Esports Development: Esports have grown in popularity worldwide, and India is no exception. The Indian esports business has the potential to thrive with proper regulation and support, drawing both players and viewers. Esports-specific factors like player contracts, tournament integrity, and licencing requirements may be addressed in the regulations.

Conclusion

Despite obstacles, India’s new online gambling legislation can potentially establish a safer and more regulated gaming sector. the future depends on successful implementation, adjusting to a shifting landscape, finding the correct balance between regulation and innovation, and promoting ethical gaming practices. The Indian online gaming business can develop sustainably with the appropriate strategy, benefiting gamers and the broader economy.

Government to certify ‘Permissible Online Games’: What you need to know

Ministry of Electronics and Information Technology (MeitY) Announces to Centre Government to Plan to Certify Permissible Online Games.

June 7, 2023

Introduction

Ministry of Electronics and Information Technology (MeitY) Announces to Centre Government to Plan to Certify Permissible Online Games.

In a recent update to the notification released by the Ministry of Electronics and Information Technology (MeitY) on April 6, MeitY has requested gaming entities to establish self-regulatory organisations (SROs) within a timeframe of 30 days or a maximum of 90 days from the date of the notification, which is April 6, 2023. The Ministry of Electronics and Information Technology (MeitY) has further announced that the central government will certify which online games are permissible until the SROs are officially established. The intention behind establishing SROs is to assist intermediaries, such as Apple or Google, in determining what constitutes a permitted online game, but the SRO will take 2-3 months to complete. In the meanwhile, the Central government will step in and determine what is a permissible online game.

Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 & Intermediary Guidelines and Digital Media Ethics Code Amendment Rules, 2023

By enacting these rules, the Indian government has taken decisive action to protect Indian gamers and their financial resources against scams and fraud. The rules also serve to promote responsible gaming while preventing young and vulnerable users from being exposed to indecent or abusive content.

Amendment Rules developed the concept of a “Permissible online real money game.” This designation is reserved for games that have passed a review process conducted by a self-regulatory body (SRB). Amendment rules indicate that Online Gaming Intermediaries must ensure that they do not permit any third party to host non-permissible online real money games on their platforms. This development is important because it empowers us to distinguish between legitimate and illicit real money games.

The Amendment Rules define an online gaming provider as an “intermediary” under the Information Technology Act of 2000, creating a separate classification called ‘Online Gaming Intermediary’.

Central government to certify what is an ‘Online Permissible Game’

The industry has been wondering what games come under wagering and will be banned. So, until the SROs are officially established, the government, in the interim, will certify what is a permissible game, what is wagering, and what is not wagering. Games that involve elements of wagering are going to be barred. The new regulations prohibit wagering on any outcome, whether in skill-based or chance-based games. Hence gaming applications involving wagering and betting apps will be barred.

Self-Regulatory Organizations (SROs)

According to the new regulations by the Ministry of Electronics and Information Technology (MeitY), online gaming intermediaries must establish a Self-Regulatory Body (SRO) to approve games offered to users over the Internet. The SRO must be registered with the Ministry and develop a framework to ensure compliance with the IT Rules 2021 objectives. An ‘online game’ can be registered by the SRO if it meets specific criteria, which include that the game is offered by an online gaming intermediary that is a member of the self-regulatory body, the game is not containing any content harmful to India’s interests, and complying with all relevant Indian regulations. If these requirements are met, the intermediary can display a visible registration mark indicating its registration with the self-regulatory authority.

Conclusion

MeitY found that with the rapid growth of the gaming industry, the real money gaming (RMG) sector had to be regulated properly. Rules framed must be properly implemented to stop gambling, betting, and wagering apps.

The IT Rules 2021, along with the Amendment Rules 2023, are created to take concrete action to curb the proliferation of gambling, betting, and wagering apps in India. These rules empower to issue of directives to ban specific apps that facilitate or promote such activities. The app ban directive allows the government to take decisive action by blocking access to these apps, making them unavailable for download or use within the country. This measure is aimed at curbing the negative impact of gambling, betting, and wagering on individuals and society, including issues related to addiction, financial loss, and illegal activities. Rules aim to actively combat the spread and influence of such apps and provide a safer online environment for gaming users.

The self-regulatory body in the context of online gaming will have the authority to grant membership to gaming intermediaries, register online games, develop a framework for regulation, interact with the Central Government, address user complaints, report instances of non-compliance, and take necessary actions to safeguard online gaming users.

New Standards - A Leap into the Future

India's Digital Leap: Learn about the nation's new tech standards for TV, USB and more.

January 23, 2023

Introduction

India has been a nation where technology penetration has been a little slower in the previous decades; however, that has changed now. Cyberspace has influenced and touched every country and has significantly diminished the gap between developing nations, developed nations, and underdeveloped nations. This has also been substantiated and strengthened during the Covid-19 pandemic as the world went into lockdown and the cyberspace was the only medium of communication and information. India witnessed a rise of 61% in terms of internet users, and a significant part of this number represented rural India.

New Standards

These standards have been released in threefold aspects covering – Digital Television Receivers, USB Type-C chargers, and Video Surveillance Systems, thus streamlining the use of gadgets and reduction of e-waste for the country.

1. Digital Television Receivers

The Indian standard IS 18112:2022 specification for digital television, and this standard would enable reception of free-to-air TV and radio channels just by connecting a dish antenna with LNB mounted on a suitable area with good signal reception. This will help in the transmission of knowledge about government initiatives and schemes, the educational content of Doordarshan, and the repository of Indian cultural programs. Doordarshan is in the process of phasing out analog transmission, and free-to-air channels will continue to be broadcast using digital satellite transmission. The keen aspects of educational and awareness programs run by the Govt and CSOs will impact more Indians than before as the Ministry of Information and Broadcast intends to increase their free channels of Doordarshan from 55 to 200 by the end of this year, which shows the importance of developments in the mass media industry.

2. USB Type C

Standard (IS/IEC 62680-1-3:2022) for USB Type-C receptacles, plugs, and cables adopting the existing global standard IEC 62680-1-3:2022. This standard provides for the requirements for USB type C ports and cables for use in various electronic devices like laptops, mobile phones, and other gadgets. This standard is similar to the new European standard, which is also aimed at the reduction of carbon emissions and e-waste; this move will result in ease for the industry and the end users. This will also contribute towards the strengthening of the cyber security aspects and prevent threats like ‘Juice Jacking’ to a massive extent.

3. Video Surveillance System

IS 16190, this standard provides a detailed outline of the aspects of a video surveillance system, such as requirements for its components like camera devices, interfaces, system requirements, and tests to ascertain the camera’s image quality on different devices. This series of standards would assist customers, installers, and users in establishing their requirements and determining the appropriate equipment required for their intended application and also provide means of evaluating the performance of the VSS objectively. This will also help in the improvement of surveillance by the individuals, and this will also help in the better investigation by Law enforcement agencies and faster apprehension of criminals, thus contributing to an overall safe society.

The Advantages

These standards are in power with the Internationally prevalent standards, thus taking the safety factors to the global aspect. This will also allow the Indian industry to create world-class products which can be shared all across the globe. This will open India to various opportunities and job avenues, thus opening the world to invest in India. The aspect of Atma Nirbhar Bharat and Digital India will be strengthened to a new level as the nation will be able to deliver products in power with quality in developed countries. The end Indian consumer will benefit the most from these upgraded standards in terms of Digital Televisions, Type ‘C’ USB chargers, and Video surveillance systems, as these impacts the consumers’ daily activities in terms of security and access to information.

Reduction in Carbon Emission
Production of World Class components and devices
Boost to the economy and Atmanirbhar Bharat
New avenues and opportunities for startups and MSMEs
Better transmission of Knowledge
Boosting FDI
Improved quality of products for the end consumer
New innovation hubs and exposure to global talents

This government move simply shows how India is working toward securing the Sustainable development Goals (SDG) by United Nations. This clearly shares the message to the world that India is ready for the future and will also be a helping hand to various developing and underdeveloped nations in the times to come.

Conclusion

These standards will significantly contribute towards the reduction of E-Waste and unnecessary accessories for daily use gadgets. This strengthens the reduction in carbon emissions and thus contributes towards the perseverance of the environment and working towards sustainable development goals. Such standards will lead the future towards securing the netizens and their new and evolving digital habits. In the current phase of cyberspace, the most essential aspect of establishing Critical Infrastructure as the same will act as a shield against the threats of cyberspace.

Navigating the Path to CyberPeace: Insights and Strategies

Featured Blogs

Introduction

The Scale of the Threat

Why Spotting the Fake Is Not Enough

Building Verification into Workflows

Extending Identity to AI Agents

Conclusion

Sources

Introduction

Why Bankers Matter

From Rupees to Crypto

The Scale of the Problem

How Authorities Are Responding

What Remains Unanswered

Conclusion

Explore Topics

Introduction

The Scale of the Threat

Why Spotting the Fake Is Not Enough

Building Verification into Workflows

Extending Identity to AI Agents

Conclusion

Sources

Introduction

Why Bankers Matter

From Rupees to Crypto

The Scale of the Problem

How Authorities Are Responding

What Remains Unanswered

Conclusion

Introduction

How the leak came to light

What data was exposed

What SBI has said

The customer notification debate

Why it matters

What customers can do now

Conclusion

Sources

Introduction

Where IFSO came from

Who takes which case

What IFSO actually does

If it happens to you or someone you know

Why the First Hour Counts

A change to watch: D4C

The takeaway

References

Introduction

What does the data shows

Emerging Trends

Risks and Implications

Policy Perspectives

The Way Forward

Conclusion

References

Introduction

What the Advisory Says

How Online Honey Traps Operate

The Risk of Malicious APK Files

Social Engineering: The Common Thread

Implications for Personal, Financial and National Security

Practical Precautions

Conclusion

Introduction

What was reported

What has been verified, and what has not

How fabricated visuals travel

Why injury and death claims are different

What responsible sharing looks like

Conclusion

Sources

The incident behind the sentence

Why "almost certainly" carries so much weight

What was actually announced

Reading it critically

A note for India

The posture worth keeping

References