Data breach menace

Excellent study material for all civil services aspirants - begin learning - Kar ke dikhayenge!

Data breach menace

---

Read more on - Polity | Economy | Schemes | S&T | Environment

---

• Dangerous news: Independent cyber-security experts have claimed in 2021 that MobiKwik customer database (worth millions of customers) was freely available for sale on the Dark Web. Mobikwik is a fintech firm, and the 8.2 TB data was available for $75000.
• Search it before you buy: The hacker who stole it all offered a special search engine to prospective buyers to confirm before they buy! All sensitive details were included. 
• Attacking the whistleblowers: The cyber expert of India who found this, was immediately attacked and vilifed by the officers of MobiKwik.

1. He was reported to authorities, to take down all his social media handles
2. The firm denied any leak at all, and agreed to conduct a third-party forensic audit by RBI
3. It "blamed" its users, saying that if they post their data on multiple sites and someone adds it all together, what can Mobikwik do about it.

• Weak legislative regime: This case once again reminds us of the extremely weak legislative regime around such data hacks, in India. Protecting private data needs much stronger regulation now. 

1. In 2017, the Supreme Court decided that Right to Privacy was a fundamental right
2. In 2019, a draft legislation by Justice Srikrishna was presented, revised many times sinces
3. In 2021, India still doesn't have any law to protect private personal data
4. No company has any obligation to disclose if any such data breach has happened, so citizens too have no redressal mechanism at all

• What happens elsewhere: Countries with such laws initiate a criminal investigation, and then come the civil class action suits (by citizens). Penalties are heavy, so companies are extra-careful.
• Still some space: India's regulators should not sit quietly, but act. The RBI has done so, in the Mobikwik case, but audit process is not clear. But it's the CERT-In that must act on this data leak. 
• CERT-In: Why it did not investigate the leak report on its own instantly, remains a mystery. This is a large breach, and won't be the last one.
• Broader picture: India has to prepare for large breaches, given that it now has more than 50 crore netizens, active policy of encouraging digital services, and no laws to protect data!  
• Summary: It's high time to legislate the relevant law, with whistleblower protections. Transparency from CERT-In like agencies will help, too.

Read more on - Polity | Economy | Schemes | S&T | Environment

Join UPSC Self Prep course | Online Course (PT Gurukul)  | Covid Special Course | Join PT courses

* Content sourced from free internet sources (publications, PIB site, international sites, etc.). Take your own subscriptions. Copyrights acknowledged.