People do not utilise time as they should while travelling

Feb 27: With the window to submit comments on India's proposed personal data protection law closing on Tuesday, a period of anxious wait for final version of the Bill started for social media firms.

This comes even as global Internet companies have called on the government for improved transparency related to intermediary Guidelines (Amendment) Rules and allay fears about the prospect of increased surveillance and prompting a fragmentation of the Internet in India that would harm users.

As per the proposed amendments, an intermediary having over 50 lakh users in the country will have to be incorporated in India with a permanent registered office and address.

When required by lawful order, the intermediary shall, within 72 hours of communication, provide such information or assistance as asked for by any government agency or assistance concerning security of the state or cybersecurity.

This means that the government could pull down information provided by platforms such as Wikipedia, potentially hampering its functioning in India.

In the open letter to IT Minister Ravi Shankar Prasad, leading browser and software development platform like Mozilla, Microsoft-owned GitHub and Cloudflare earlier called for improved transparency by allowing the public an opportunity to see a final version of these amendments prior to their enactment.

According to a Business Insider report, Indian users may lose access to Wikipedia if the new intermediary rules for internet and social media companies are approved.

Since the rules would require the website to take down content deemed illegal by the government, it would require Wikipedia to show different content for different countries.

Anusha Alikhan, senior communications director for Wikimedia told Business Insider that the platform is built though languages and not geographies. Therefore, removing content from one country, while it is still visible to other country users may not work for the company’s model.

India is one of Wikipedia’s largest markets. Over 771 million Indian users accessed the site in just November 2019.

Also read: Explained: What is the Personal Data Protection Bill and why you should care

The Personal Data Protection Bill, 2019, which was introduced in Lok Sabha in the winter session last year, was referred to a Joint Parliamentary Committee (JPC) of both the Houses.

The government last month decided to seek views and suggestions on the Bill from individuals and associations and bodies concerned and the last date for submitting the comments was on Tuesday.

Prasad, while introducing the Personal Data Protection Bill, 2019, in the Lok Sabha on December 11, announced that the draft Bill empowers the government to ask companies including Facebook, Google and others for anonymised personal data and non-personal data.

There was a buzz when the Bill's latest version was introduced in the Lok Sabha, especially the provision seeking to allow the use of personal and non-personal data of users in some cases, especially when national security is involved.

Several legal experts red-flagged the issue and said the provision will give the government unaccounted access to personal data of users in the country.

In their submission to the JPC, several organisations also flagged that the power to collect non-personal and anonymised data by the government without notice and consent should not form part of the Bill because of issues regarding effective anonymisation and potential abuse.

"Clauses 35 and 36 of the Bill provide unbridled access to personal data to the Central Government by giving it powers to exempt its agencies from the application of the Bill on the basis of various broad worded grounds," SFLC.in, a New Delhi-based not-for-profit legal services organisation, commented.

The Software Alliance, also known as BSA, a trade group which includes tech giants such as Microsoft, IBM and Adobe, among others said that the current version of the privacy bill pose substantial challenges, including the sweeping new powers for the government to acquire non-personal data, restrictions on data transfers, and local storage requirements.

"We urge the Joint Parliamentary Committee, as it considers revisions to the Bill, to eliminate provisions concerning non-personal data from the Personal Data Protection Bill and to remove the data localisation requirements and restrictions on international data flows," said Venkatesh Krishnamoorthy, Country Manager-India, BSA.

The Personal Data Protection (PDP) Bill, 2019 draws its origins from the Justice B.N. Srikrishna Committee on data privacy, which produced a draft of legislation that was made public in 2018 ("the Srikrishna Bill").

The mandatory requirement for storing a mirror copy of all personal data in India as per Section 40 of the Srikrishna Bill has been done away with in the PDP Bill, 2019, meaning that companies like Facebook and Twitter would be able to store data of Indian users abroad if they so wish.

But the bill prohibits processing of sensitive personal data and critical personal data outside India.

What is more, what constitutes critical data has not been clearly defined.

As per the proposals, social media companies will have to modify their application as they are required to have a system in place by which a user can verify themselves.

So legal experts believe that some system to upload identification documents should be there and something like the Twitter blue tick mark should be there to identify verified accounts.

"The 2019 Bill introduces a new category of data fiduciaries called social media intermediaries ('SMIs'). SMIs are a subcategory of significant data fiduciaries ('SDFs') and will be notified by the Central government after due consultation with the DPA, or the Data Protection Authority. Clause 26(4) of the Bill defines SMIs as intermediaries who primarily or solely enable online interaction between two or more users," SFLC.in said.

"On a plain reading of the definition, online platforms like Facebook, Twitter, YouTube, TikTok, ShareChat and WhatsApp are likely to be notified as SMIs under the Bill," it added.

Soon, you may be able to withdraw cash from an ATM without touching any part of the machine. AGS Transact Technologies, a provider of cash and digital payment solutions and automation technology, on Monday said it has successfully developed and tested a touchless ATM solution in light of the COVID-19 pandemic.

The ‘contactless' solution, currently under demo at interested banks, enables a customer to perform all the steps required to withdraw cash from an ATM using the mobile app itself. 

The customer simply has to scan the QR code displayed on the ATM screen and follow the directions on their respective bank's mobile application. 

This includes entering the amount and mPIN required to dispense the cash from the ATM machine. 

According to the company, the QR code feature makes cash withdrawals quicker and more secure, and negates the chances of compromising the ATM Pin or card skimming.

"The new Touchless ATM solution is an extension of the flagship QR Cash solution which ensures safety of the users and will provide a seamless cash withdrawal experience with enhanced security," said Ravi B. Goyal, Chairman and MD, AGS Transact Technologies Ltd.

With minimum investment, the banks can enable this solution for their ATM networks by upgrading the existing software.

AGSTTL has so far installed, maintained and managed a network of over 72,000 ATMs across the country and also provides customised solutions to leading banks. 

The company earlier introduced UPI-QR based Cash withdrawal solution in partnership with Bank of India. 

This is how the solution works.

Open the Bank mobile application on your smartphone and select QR Cash Withdrawal. Enter the amount you wish to withdraw on the mobile app and scan the QR code on the ATM screen.

Next, confirm the amount by clicking on ‘proceed' in the app and enter the mPin to authenticate the transaction. Now collect the cash and receipt and you are done.

"The seamless, cardless and touchless withdrawal method is designed to provide easy transaction flow, without the need to touch the ATM screen or enter the pin," said Mahesh Patel, President and Group Chief Technology Officer, AGS Transact Technologies.

New Delhi, Jul 18: India's national cybersecurity agency CERT-in, has warned people of credit card skimming spreading across the world through e-commerce platforms.

Attackers are typically targeting e-commerce sites because of their wide presence, popularity and the environment LAMP (Linux, Apache, MySQL, and PHP), the Computer Emergency Response Team (CERT-In) said in a notice on Thursday.

Recently, attackers targeted sites which were hosted on Microsoft's IIS server running with the ASP.NET web application framework, it said.

Some of the sites affected by the attack were found to be running ASP.NET version 4.0.30319, which is no longer officially supported by Microsoft and may contain multiple vulnerabilities, CERT-In said.

The notice also included a list of best practices for website developers including the use of the latest version of ASP.NET web framework, IIS web server and database server.

The advisory is based on research by Malwarebytes which found that this skimming campaign likely began sometime in April this year.

Credit card skimming has become a popular activity for cybercriminals over the past few years, and the increase in online shopping during the pandemic means additional business for them, too, Malwarebytes said in a blog post, adding that attackers do not need to limit themselves to the most popular e-commerce platforms.

Researchers from global cybersecurity and anti-virus brand Kaspersky had warned in December last year that more cybercriminal groups will target online payment processing systems in 2020. 

It said that over the past couple of years, so-called JS-skimming (the method of stealing of payment card data from online stores), has gained immense popularity among attackers. 

Kaspersky researchers in their report said they are currently aware of at least 10 different actors involved in these type of attacks.

Their number will continue to grow during the next year, the report said, adding that the most dangerous attacks will be on companies that provide services such as e-commerce as-a-service, which will lead to the compromise of thousands of companies.