India among top targets of spying by NSA

...In the overall list of countries spied on by NSA programs, India stands at fifth place, with billions of pieces of information plucked from its telephone and internet networks just in 30 days....

...... SIGINT (signal intelligence) system collects electronic surveillance program records or internet data (DNI) and telephone call metadata records (DNR), which is all stored in an NSA archive called GM-PLACE.....

.....Three “global heat maps,” which give each country a colour code based on how extensively it was subjected to NSA surveillance, clearly show that India was one of the hottest targets for U.S. intelligence.....

 ....the top-secret documents obtained by The Hindu show that this internal NSA tool focusses on counting and categorising the telephone calls and Internet records as well as on storing and retrieving...

 ........“By accessing metadata, you can learn an awful lot about an individual. With mobile phones, location data has now been added to metadata. With the Internet, you can in addition understand someone’s location in a social network in much more detail, as well as understand how that network relates to other networks......

Click here to read more ...

Indian Govt May Ban U.S. Based E-mail Services For Official Communication

....Wary of cyber snooping, the government may ban use of e-mail services such as Gmail and Yahoo for official communications so as to safeguard its critical data....

....The Department of Electronics and Information Technology is drafting a policy on e-mail usage in government offices and departments, which will be released in two months.....

.....The government will send a formal notification after the policy is implemented in about two months covering about 5-6 lakh Central and State government employees to use the email service provided by National Informatics Centre (NIC).....

....The development comes close on heels of concerns being raised by a section in the government, especially intelligence agencies, over use of email services, provided by foreign firms (mostly US-based), which have their servers located in overseas locations, making it difficult to track if sensitive government data is being snooped upon....


Click here to read more ......

India- The New Talent Hotspot For Cyber Criminals

......India is emerging as talent hotspot for black-hat hackers, thanks to slow hiring in the software industry, easy money, and lack of proper law enforcements......

.....Global cyber crime groups are outsourcing the jobs of hacking and creating malwares to India through cyber-mercenaries, who work underground.....

....."Increasingly, India is becoming not just the victim but the host country with regard to cyber attacks," said Jagdish Mahapatra, MD for India and SAARC at McAfee, the antivirus company....

Click here to read more ......

India’s first Cyber Forensic Lab sets up in Tripura

India’s first Cyber Forensic Laboratory (CFL) has been set up in Tripura, an official said Monday. The lab, established at the Tripura High Court will provide court case related information.

....Supreme Court judge Justice Madan B. Lokur, who was earlier the chief justice of the Gauhati High Court, inaugurated the CFL on Sunday....

.....“A National Judicial Data Grid (NJDG) is being developed under the Supreme Court’s supervision. All information about legal services, court cases and judicial actions would be available from the NJDG,” Lokur said...

......“So far, 13,000 judicial officers, including judges, have been trained about the e-court system and to equip them with the ongoing modernization of legal services.....

.....“With this new system of trial and administrative works, the litigants will be immensely benefited. It will save both time and money to get quick justice and prompt disposal of cases,” Lokur said......

Click here to read more .....

Step into the BREACH: New attack developed to read encrypted web data

..... A new hacking technique dubbed BREACH can extract login tokens, session ID numbers and other sensitive information from SSL/TLS encrypted web traffic, say researchers.....

.....BREACH (short for Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) attacks the commonDeflate data compression algorithm used to save bandwidth in web communications.......

.....The attacker just has to continually eavesdrop on the encrypted traffic between a victim and a web server before tricking marks into visiting a website under the miscreant's control.....

.....The attacker's booby-trapped website hosts a script that runs the second phase of the attack: this forces the victim's browser to visit the targeted website thousands of times, over and over, each time appending a different combination of extra data......

.....The practical upshot is that tokens and other sensitive information sent over SSL connections could be lifted even though the encrypted contents of emails and one-off orders sent to e-commerce websites are beyond the scope of the attack......

Click here to read more .....

Rs 2.4-cr cyber theft: Cops recover half the amount, 13 arrested so far

The Worli police, probing the theft of Rs 2.4 crore from the Yes Bank account of RPG Group, has recovered more than half the stolen amount. Police have so far arrested 13 persons from Chennai and Delhi..... 

.....The money was deposited in 12 bank accounts across the country. Most of the arrested accused were individuals who were instructed to simply deliver the money to the mastermind once it was credited to their account, police said.....

.....The police have had a hard time finding the account holders at the addresses they provided to the bank. They had written to banks in Bangalore, Chennai, Coimbatore, Thiruvananthapuram, Meghalaya, Barrackpore, Delhi and Noida, where the money was credited, to obtain the KYC details of account holders......

Click here to read more ........

TrueCaller hacked, 1 million Indians’ data at risk

 ...Global phone directory app TrueCaller has been hacked by hacktivist groupSyrian Electronic Army (SEA).....

...Syrian Electronic Army broke the news via a tweet saying, "Sorry @TrueCaller, we needed your database, thank you for it." The hackers openly released TrueCaller's database host ID, username and password via another tweet....

..The app's databases have access codes to Facebook, Twitter, LinkedIn and Gmail accounts of millions of users globally. Reports say that TrueCaller website went down for a while but is now back online.....

...The Syrian hacking collective revealed that it exploited the TrueCallerwebsite as it is based on outdated Wordpress platform, which gave them access to the admin panel....
Click here to read more ......

Cyber sleuths caution Windows XP users against hacking

Indian cyber security sleuths have issued an alert for those using the popular Window XP operating system (OS) on their computers and advised “immediate” upgrade of software to protect against hackingattempts.

...... Microsoft had announced it was going to stop support services to Windows XP from April 8 next year....

...In the absence of patches and security updates for the Windows XP OS, the computer systems would be at greater risks and could be easily compromised by the hackers..... 

..... most Indian users operate on the Windows platform and after the recent declaration, users should keep themselves informed about the new and secure OS available in the market.....
Click here to read more .....

Snowden leak: Microsoft added Outlook.com backdoor for Feds

There are red faces in Redmond after Edward Snowden released a new batch of documents from the NSA's Special Source Operations (SSO) division covering Microsoft's involvement in allowing backdoor access to its software to the NSA and others.
.....Microsoft's cloud storage service SkyDrive is also easy to access.......The agency reported on April 8, 2013 that Microsoft has built PRISM access into Skydrive in such a way as to remove the need for NSA analysts to get special authorization for searches in Microsoft's cloud........
....The leaked documents come from the NSA's Special Source Operations (SSO) division, which handles commercial company liaison for data collection by the agency. The documents show that, once collected by Prism, the NSA shares its data directly with the CIA and FBI via a custom application....

..."In practice, US companies put energy, focus and commitment into consistently protecting the privacy of their customers around the world, while meeting their obligations under the laws of the US and other countries in which they operate.".....

Click here to read more ...

HP admits to backdoors in storage products

Hewlett-Packard has agreed that there is an undocumented administrative account in its StoreVirtual products, and is promising a patch by 17 July.

.....HP has now issued this security advisory, stating:

“This vulnerability could be remotely exploited to gain unauthorized access to the device.
“All HP StoreVirtual Storage systems are equipped with a mechanism that allows HP support to access the underlying operating system if permission and access is provided by the customer. This functionality cannot be disabled today.
“HP has acknowledged this vulnerability and will provide a patch that will allow customers to disable the support access mechanism on or before July 17, 2013”...

"...Although data isn't accessible via the backdoor, one user with around 50 TB of StoreVirtual capacity said the account gave sufficient access to reboot nodes in a cluster, “and so cripple the cluster"....

Click here to read more ....

Cyber Security JWG for casting the net wide to rope in professionals

With India becoming more vulnerable to cyber attacks, the Joint Working Group on Cyber Security has said shortage of professionals in the sector should be tackled in a mission mode, with innovative recruitment and placement procedures.

...The JWG, working under the National Security Council Secretariat, which is headed by the National Security Adviser, has called for a concerted effort to increase the number of cyber security professionals and equip them to efficiently meet the challenges.....

...It said the Home Ministry, along with the IT Ministry, could set up training facilities for law enforcement agencies in cyber crime investigation and cyber forensics.....

...The JWG has recommended that a multi-disciplinary centre of excellence be established on cyber security. It has identified guiding principles that would underpin the public-private partnership (PPP) in cyber security......

Click here to read more .....

Rules under Section 69 Information Technology Act 2000

NOTIFICATION

New Delhi, the 27^th October, 2009

G.S.R. 780 (E).— In exercise of the powers conferred by clause (y) of sub-section (2) of section 87, read with sub-section (2) of section 69 of the Information Technology Act, 2000 (21 of 2000), the Central Government hereby makes the following rules, namely:

1.  Short title and commencement— (1) These rules may be called the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009.             (2)  They shall come into force on the date of their publication in the Official Gazette.

2. Definitions—In these rules, unless the context otherwise requires, --

(a) 'Act' means the Information Technology Act. 2000 (21 of 2000);

(b)'communication' means dissemination, transmission, carriage of information or signal in some manner and include both a direct communication and an indirect communication;

(c)'communication link' means the use of satellite, microwave, radio, terrestrial line, wire, wireless or any other communication media to inter-connect computer resource;

(d)'competent authority' means -

(I) The Secretary in the Ministry of Home Affairs, in case of the Central Government; or

(II) The Secretary in charge of the Home Department, in case of a State Government or Union territory, as the case may be;

(e) 'Computer resource' means computer resource as defined in clause (k) of sub-section (1) of section 2 of the Act;

(f)'decryption' means the process of conversion of information in non-intelligible form to an intelligible form via a mathematical formula, code, password or algorithm or a combination thereof;

(g)'decryption assistance' means any assistance to -

(I) allow access, to the extent possible, to encrypted information; or

(II) Facilitate conversion of encrypted information into an intelligible form;

(h)'decryption direction' means a direction issued under rule 3 in which a decryption key holder is directed to -

(I)disclose a decryption key; or

(II)provide decryption assistance in respect of encrypted information

(i)'decryption key' means any key, mathematical formula, code, password, algorithm or any other data which is used to -

(I)allow access to encrypted information; or

(II)facilitate the conversion of encrypted information into an Intelligible form;

(j) 'decryption key holder' means any person who deploys the decryption mechanism and who is in possession of a decryption key for purposes of subsequent decryption of encrypted information relating to direct or indirect communications;

(k) 'information' means information as defined in clause (v) of sub-section (1) of section 2 of the Act;

(I) 'intercept' with its grammatical variations and cognate expressions, means the aural or other acquisition of the contents of any information through the use of any means, including an interception device, so as to make some or all of the contents of a information available to a person other than the sender or recipient or intended recipient of that communication, and includes—

(a)monitoring of any such information by means of a monitoring device;

(b)viewing, examination or inspection of the contents of any direct or indirect information; and

(c)diversion of any direct or indirect information from its intended destination to any other destination;

(m)'Interception device' means any electronic, mechanical, electro-mechanical, electro-magnetic, optical or other instrument, device, equipment or apparatus which is used or can be used, whether by itself or in combination with any other instrument, device, equipment or apparatus to intercept any information; and any reference to an "interception device' includes, where applicable, a reference to a 'monitoring device';

(n)'intermediary' means an intermediary as defined in clause (w) of sub-section (1) of section 2 of the Act;

(o)"monitor' with its grammatical variations and cognate expressions, includes to view or to inspect or listen to or record information by means of a monitoring device;

(p)'monitoring device means any electronic, mechanical, electro-mechanical, electro-magnetic, optical or other instrument, device, equipment or apparatus which is used or can be used, whether by itself in combination with any other instrument, device, equipment or apparatus, to view or to inspect or to listen to or record any information;

(q)'Review Committee' means the Review Committee constituted under rule 419A of Indian Telegraph Rules, 1951.

3. Directions for interception or monitoring or decryption of any Information — No person shall carry out the interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource under Sub-section (2) of section 69 of the Act, except by an order issued by the competent authority;

Provided that in an unavoidable circumstances, such order may be issued by an officer, not below the rank of the Joint Secretary to the Government of India, who has been duly authorised by the competent authority;

Provided further that in a case of emergency-

(I) In remote areas, where obtaining of prior directions for interception or monitoring or decryption of information is not feasible; or

(II) for operational reasons. where obtaining of prior directions for interception or monitoring or decryption of any information generated, transmitted, received or stored In any computer resource is not feasible,

the interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource may be carried out with the prior approval of the Head or the second senior most officer of the security and law enforcement agency (hereinafter referred to as the said Security agency) at the Central level and the officer authorised in this behalf, not below the rank of the Inspector General of Police or an officer of equivalent rank, at the Stale or Union territory level;

Provided also that the officer, who approved such interception or monitoring or decryption of information in case of emergency, shall inform in writing to the competent authority about the emergency and of such interception or monitoring or decryption within three working days and obtain the approval of the competent authority thereon within a period of seven working days and if the approval of competent authority is not obtained within the said period of seven working days, such Interception or monitoring or decryption shall cease and the information shall not be intercepted or monitored or decrypted thereafter without the prior approval of the competent authority.

4. Authorisation of agency of Government- The competent authority may authorise an agency of the Government to intercept, monitor or decrypt information generated, transmitted, received or stored in any computer resource for the purpose specified in sub-section (1) of section 69 of the Act.

5. Issue of decryption direction by competent authority — The competent authority may, under rule 3 give any decryption direction to the decryption key holder for decryption of any information involving a computer resource or part thereof.

6. Interception or monitoring or decryption of information by a State beyond its Jurisdiction— Notwithstanding anything contained in rule 3, if a State Government or Union territory Administration requires any interception or monitoring or decryption of information beyond its territorial jurisdiction, the Secretary in-charge of the Home Department in that State or Union territory, as the case may be, shall make a request to the Secretary in the Ministry of Home Affairs, Government of India for issuing direction to the appropriate authority for such interception or monitoring or decryption of information.

7. Contents of direction — Any direction issued by the competent authority under rule 3 shall contain reasons for such direction and a copy of such direction Shall be forwarded to the Renew Committee within a period of seven working days.

8. Competent authority to consider alternative means in acquiring Information- The competent authority shall, before issuing any direction under rule 3, consider possibility of acquiring the necessary information by other means and the direction under rule 3 shall be issued only when it is not possible to acquire the information by any other reasonable means.

9.Direction of interception or monitoring or decryption of any specific information— The direction of interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource shall be of any information as is sent to or from any person or class of persons or relating to any particular subject whether such information or class of information are received we one or more computer resources, or being a computer resource likely to be used for the generation, transmission, receiving, storing of information from or to one particular person or one or many set of premises, as may be specified or described in the direction.

10.Direction to specify the name and designation of the officer to whom information to be disclosed — Every directions under rule 3 shall specify the name and designation of the officer of the authorised agency to whom the intercepted or monitored or decrypted or stored information shall be disclosed and also specify that the use of Intercepted or monitored or decrypted information shall be subject to the provisions of sub-section (1) of section 69 of the said Act.

11.Period within which direction shall remain in force — The direction for interception or monitoring  or decryption shall remain in force, unless revoked earlier, for a period not exceeding sixty days from the date of its issue and may be renewed from time to time for such period not exceeding the total period of one hundred and eighty days.

12. Authorised agency to designate nodal officer— The agency authorised by the competent    authority under rule 4 shall designate one or more nodal officer, not below the rank of Superintendent of Police or Additional Superintendent of Police or the officer of the equivalent rank, to authenticate and send the requisition conveying direction issued under rule 3 for interception, or monitoring or decryption to the designated officers of the concerned intermediaries or person in-charge of computer resource;

Provided that an officer, not below the rank of Inspector of Police or officer of equivalent rank, Shall deliver the requisition to the designated officer of the Intermediary.

13. Intermediary to provide facilities, etc.— (1) The officer issuing the requisition conveying direction issued under rule 3 for interception or monitoring or decryption of information shall also make a request in writing to the designated officers of intermediary or person in-charge of computer resources, to provide all facilities, co-operation and assistance for interception or monitoring or decryption mentioned in the direction.

(2)On the receipt of request under sub-rule (1), the designated officers of intermediary or person in-charge of computer resources, shall provide all facilities, co-operation and assistance for interception or monitoring or decryption of information mentioned in the direction.

(3)Any direction of decryption of information issued under rule 3 to intermediary shall be limited to the extent the information is encrypted by the intermediary or the intermediary has control over the decryption key.

14.Intermediary to designate officers to receive and handle requisition— Every intermediary or  person in-charge of computer resource shall designate an officer to receive requisition, and another officer to handle such requisition, from the nodal officer for interception or monitoring or decryption of information generated, transmitted, received or stored in any computer resource.

15.Acknowledgement of instruction — The designated officer of the intermediary or person in-charge of computer resources shall acknowledge the instructions received by him through letters or fax or email signed with electronic signature to the nodal officer of the concerned agency within two hours on receipt of such intimation or direction for interception or monitoring or decryption of information.

16.Maintenance of records by designated officer— The designated officer of intermediary or person  in-charge of computer resource authorised to intercept or monitor or decrypt any information shall maintain proper records mentioning therein, the intercepted or monitored or decrypted information, the particulars of persons, computer resource, e-mail account, website address. etc whose information has been intercepted or monitored or decrypted, the name and other particulars of the officer or the authority to whom the intercepted or monitored Of decrypted information has been disclosed, the number of copies, including corresponding electronic records of the intercepted or monitored or decrypted information made and the mode or the method by which such copies, including corresponding electronic record are made, the date of destruction of the copies, including corresponding electronic record and the duration within which the directions remain in force.

17. Decryption key holder to disclose decryption key Or provide decryption assistance— If a decryption direction or a copy thereof is handed to the decryption key holder to whom the decryption direction is addressed by the nodal officer referred to in rule 12, the decryption key holder shall within the period mentioned in the decryption direction -

(a) disclose the decryption key; or

(b) provide the decryption assistance,

Specified in the decryption direction to the concerned authorised person.

18. Submission of list of Interception or monitoring or decryption of information— (1) The designated officers of the intermediary or person in-charge of computer resources shall forward in every fifteen days a list of interception or monitoring or decryption authorisations received by them during the preceding fortnight to the nodal officers of the agencies authorised under rule 4 for confirmation of the authenticity of such authorizations.

(2) The list referred to in sub-rule (1) shall include details, such as the reference and date of orders of the concerned competent authority including any order Issued under emergency cases, date and time of receipt of such order and the date and time of implementation of such order.

19. Intermediary to ensure effective check In handling matter of Interception or monitoring or decryption of Information— The intermediary or the person n-charge of the computer resource so directed under rule 3, shall provide technical assistance and the equipment including hardware, software, Firmware, storage, interface and access to the equipment wherever requested by the agency authorised under rule 4 for performing interception or monitoring or decryption including for the purposes of-

(I)the installation of equipment of the agency authorised under rule 4 for the purposes of interception or monitoring or decryption or accessing stored information in accordance with directions by the nodal officer; or

(II)the maintenance, testing or use of such equipment; or

(III)the removal of such equipment; or

(iv) the performance of any action required for accessing of stored information under the direction issued by the competent authority under rule 3.

20. Intermediary to ensure effective check In handling matter of interception or monitoring or decryption of Information— The intermediary or person in-charge of computer resources shall put in place adequate and effective internal checks to ensure the unauthorised interception of information does not take place and extreme secrecy is maintained and utmost care and precaution shall be taken in the matter of interception or monitoring or decryption of information as it affects privacy of citizens and also that it is handled only by the designated officers of the intermediary and no other person of the intermediary or person in-charge of computer resources shall have access to such intercepted or monitored or decrypted information.

21. Responsibility of Intermediary— The intermediary or person in-charge of computer resources shall be responsible for any action of their employees also and in case of violation pertaining to maintenance of secrecy and confidentiality of information or any unauthorized interception or monitoring or decryption of information, the intermediary or person in-charge of computer resources shall be liable for any action under the relevant provisions of the laws for the time being in force.

22. Review of directions of competent authority— The Review Committee shall meet at least once in two months and record its findings whether the directions issued under rule 3 are in accordance with the provisions of sub-section (2) of section 69 of the Act and where the Review Committee is of the opinion that the directions are not in accordance with the provisions referred to above, it may set aside the directions and issue order for destruction of the copies, including corresponding electronic record of the intercepted or monitored or decrypted information.

23. Destruction of records of Interception or monitoring or decryption of information— (1) Every record, including electronic records pertaining to such directions for interception or monitoring or decryption of information and of intercepted or monitored or decrypted information shall be destroyed by the security agency in every six months except in a case where Such information is required, or likely to be required for functional requirements.

 (2) Save as otherwise required for the purpose for any ongoing investigation, criminal complaint or legal proceedings, the intermediary or person in-charge of computer resources shall destroy records pertaining to directions for Interception of information within a period of two months of discontinuance of the Interception or monitoring or decryption of such information and in doing so they shall maintain extreme secrecy.

24. Prohibition of interception or monitoring or decryption of information without authorisation —  (1) Any person who intentionally or knowingly, without authorisation under rule 3 or rule 4, intercepts or attempts to intercept, or authorises or assists any other person to intercept or attempts to intercept any information in the course of its occurrence or transmission at any place within India, shall be proceeded against and punished accordingly under the relevant provisions of the laws for the time being in force.

(2) Any interception, monitoring or decryption of Information in computer resource by the employee of an intermediary or person in-charge of computer resource or a person duly authorised by the intermediary, may be undertaken in course of his duty relating to the services provided by that intermediary, if such activities are reasonably necessary for the discharge his duties as per the prevailing industry practices, in connection with the following matters, namely-

(I) installation of computer resource or any equipment to be used with computer resource; or

(II) operation or maintenance of computer resources; or

(III) installation of any communication link or software either at the end of the intermediary or subscriber, or installation of user account on the computer resource of intermediary and testing of the Same for its functionality;

(iv)accessing stored information from computer resource relating to the installation, connection or maintenance of equipment, computer resource or a communication link or code; or

(v)accessing stored information from computer resource for the purpose of—

(a)implementing information security practices in the computer resource;

(b)determining any security breaches, computer contaminant or computer virus;

(c)undertaking forensic of the concerned computer resource as a part of investigation or internal audit, or

(iv) accessing or analysing information from a computer resource for the purpose of tracing a computer resource or any person who has contravened, or is suspected of having contravened or being likely to contravene, any provision of the Act that is likely to have an adverse impact on the services provided by the intermediary.

(3) The intermediary or the person in-charge of computer resource and its employees shall maintain strict secrecy and confidentiality of information while performing the actions specified under sub- rule (2)

25. Prohibition of disclosure of intercepted or monitored or decrypted information — (1) The contents of intercepted or monitored or stored or decrypted information shall not be used or disclosed by intermediary or any of its employees or person in-charge of computer resource to any person other than the intended recipient of the said information under rule 10.

(2)The contents of intercepted or monitored or decrypted information shall not be used or disclosed by the agency authorised under rule 4 for any other purpose, except for investigation or sharing with other security agency for the purpose of investigation or in judicial proceedings before the competent court in India.

(3)Save as otherwise provided in sub-rule (2), the contents of intercepted or monitored or decrypted information shall not be disclosed or reported in public by any means, without the prior order of the competent court in India.

(4)Save as otherwise provided in Sub-rule (2), strict confidentiality shall be maintained in respect of direction for interception, monitoring or decryption issued by concerned competent authority or the nodal officers.

(5)My Intermediary or its employees or person in-charge of computer resource who contravenes provisions of these rules shall be proceeded against and punished accordingly under, the relevant provisions of the Act for the time being in force.

(6)Whenever asked for by the concerned security agency at the Centre the security agencies at the State and the Union territory level shall promptly share any information which they may have obtained following directions for interception or monitoring or decryption of any information generated, transmitted, received or stored in any computer resource under rule 3, with the security agency at the Centre.

                                                                                                              Sd/-                      

[No.9(16/2004-EC)]                                                                                                                                N. RAVI SHANKER, Jt. Secy

Amid spying saga, India unveils cyber security policy

The government on Tuesday unveiled the National Cyber Security Policy, aimed at protecting the public and private infrastructure from cyber attacks. 
The policy also intends to safeguard "information, such as personal information (of webs users), financial and banking information and sovereign data"......
...."This policy is a framework document and it gives you a broad outline of our vision. The real task or the challenge is the operationalisation of this policy," minister of communications and IT Kapil Sibal said while releasing the document in Delhi.....
.....The policy states it aims to "provide confidence and reasonable assurance to all stakeholders in the country (government, business, industry and general public) and global community, about the safety, resiliency and security of cyber space"......
...Other measures discussed in the policy include training five lakh cyber security professionals in the next five years, focus on the use of open source software for government services and proper validation of IT products and services used by government departments.....

Click here to read more ...

Cyber crooks create fake Delhi Jal Board site

....The Delhi Jal Board has lodged a complaint against a fake department website, very similar to the real one, that may have been used to dupe consumers....
....The team of cyber cell experts is investigating the case and an FIR under the information technology (66A) Act has been registered, a senior police officer said. ....
....Cops are now trying to trace the IP address of the website through which they would zoom in to the location and computer where it was created , a source said.....
...According to the complaint lodged by DJB chief engineer R S Tyagi,the board's official website links with with that of the Delhi government , which is managed by the National Information Commission (NIC)....
Click here to read more .....

US cyber spying foiled over 50 terror plots worldwide, including India

The controversial secret cyber spying programme run by America's National Security Agency (NSA) foiled more than 50 potential terrorist plots in as many as 20 countries, including India.

"The plot included a previously undisclosed plan to blow up the New York Stock Exchange," according to the testimony of NSA chief General Keith Alexander before the House Intelligence Committee.

....Informed sources, however, told PTI that India was among those 20 countries and the time frame of at least one such India-related plot indicate it was around the successful Commonwealth Games in Delhi in 2010.....

.."These programs are limited, focused and subject to rigorous oversight. They have distinct purposes and oversight mechanisms. We have rigorous training programmes for our analysts and their supervisors to understand their responsibilities regarding compliance," Alexander said.

"The disciplined operation of these programmes protects the privacy and civil liberties of the American people," the NSA chief....

Click here to read more ...

Cyber cell freezes fraudulent account

The Pune cyber crime cell convinced its Chinese counterpart to freeze a fraudulent account in which a city-based business supplier had deposited Rs 46 lakh.

...An online fraudster got wind of the impending transaction and forged an e-mail id, posing as the Chinese supplier, and stated that he had created a new bank account for the transaction....

....The fraud came to light only after the Chinese supplier informed Bhagchandani that he had not received the money.

On June 17, Bhagchandani registered a complaint with the cyber crime cell for investigating the fraud.

.....The cell officials said that since the fraudster was in the process of withdrawing the money, the transaction was aborted in time....

Click here to read more ...

Forces must be equipped with dynamic cyber warfare tools: Kalam

....former president APJ Abdul Kalam on Thursday stressed on the need to equip future officers of armed forces to envisage and combat technology-driven warfare....

"The whole war environment will be a network centric warfare and it could be electronically controlled...

...."In technology-centric crimes and war, the crime may originate from a strange place outside the nation shores and may damage the organisational wealth which will be in digital form.

...... the tools of war have also changed to economic competition, control of market forces, essential items like energy, he said, adding that in the next two decades, anti-ballistic defence systems are going to be a major force......
 Click here to read more ....

Mumbai police for second cyber crime station

The Mumbai police have asked the state government to set up a second cyber crime police station in the city after the latest National Crime Records Bureau report showed a worrying three-fold increase in online offences here....
.... the police wrote to the government last week proposing the creation of a new cyber crime police station in the suburbs along the lines of the one in Bandra-Kurla Complex (BKC)....
....Officers trained in fighting online crimes and currently posted in local police stations will be chosen for the new station....
... Mumbai has been wracked by a series of major online frauds in the recent past. In January, two brothers hacked into the current account of a Mulund-based cosmetic firm's director and stole Rs 1 crore....
.. in May  cyber criminals hacked a current account of the RPG Group of companies and siphoned off Rs 2.41 crore in three hours..
...growing crime numbers in the city reflect the swelling figures in the state...

Click here to read more .....

An IT superpower, India has just 556 cyber security experts

The world may acknowledge India as an information technology superpower, but its very own official cyber security workforce comprises a mere 556 experts deployed in various government agencies. How “grossly inadequate” is India’s cyber security manpower can be gauged by the fact that China has 1.25 lakh experts, the U.S. 91,080 and Russia 7,300. ..

....the government has decided to recruit 4,446 experts to be deployed in six organisations that would take care of India’s cyber security infrastructure.....

.... India is also setting up its own ‘cyber security architecture’ that will comprise the National Cyber Coordination Centre (NCCC) for threat assessment and information sharing among stakeholders...

.....The NSCS has identified over a dozen ‘critical information infrastructure’ sectors/ facilities requiring protection. These include the civil aviation sector (Air Traffic Control or ATC), Railways’ passenger reservation system and communication network, port management, companies and organisations in power, oil and natural gas sectors, banking and finance, and telecom sectors.....

Click here to read more ...

Exclusive: ‘Location tracking’ of every Indian mobile user by 2014

The government has directed all telecom service providers to make location details, a mandatory part of call data records (CDR) of all mobile users in the country, starting mid- 2014, according to a Department of Telecommunications (DoT) directive obtained byFirstpost.....
..... While the location tracking exercise has its genesis in a DoT order issued in May 2011, its effect on the ground should be visible from mid- 2014.

To start with, these details will be provided for specified mobile numbers. “However, within a period of three years location details shall be part of CDR for all mobile calls,” said the directive.....

....Jiten Jain, Delhi based cyber security analyst, said that going by the kind of information which the government already possess, it is not surprising if location details become part of CDR. “But monitoring the location of every citizen is like creating a monster,” he said.......

Click here to read more ...

India Inc should wake up to the cyber threats

.....The government is readying a cyber security framework, a cyber security policy and a National Cyber Coordination Centre (NCCC) that will monitor metadata on cyber traffic flows.....
......strong public-private partnership can secure the nation and its vital functions. This calls for coordinated action on multiple fronts. One is policy and legislation, to ensure integrity and accountability to cyber monitoring......
...The government proceeds as if one clause in the Information Technology Act is enough to protect Indians' privacy....
... A second front is technological capability. From setting standards and testing of equipment to advances in cryptography.....
.......Public awareness and involvement is the third area of action. From passive securing of individual phones and computers to active research in combating cyber attacks and snooping, a range of activity calls for vigorous participation by India's youth......

Click here to read more ...

New cyber security body to rope in ISPs

Indian government is rolling out a new cybersecurity architecture at a time when it turns out that India is among the top five countries whose data has been compromised by the US' NSA surveillance system.

..The new architecture, which was cleared by the Cabinet last month, envisages an interconnected set of organizations in key departments....

...A key aspect of the architecture is that the government will work with ISPs to oversee metadata of Indian users but not mine the data.....

...However, unlike China, India has lagged behind in implementing IPv6 (internet protocol) which is not only more secure but also makes it easier to "hide" certain important information through encryption that is not possible under the current IPv4 in use here....

....The expectation is that the new cybersecurity policy will somehow stop the sniping that happens regularly between Indian cyber entities....

Click here to read more .....

India gets ready to roll out cyber snooping agency

.......National Cyber Coordination Centre (NCCC) — that would carry out “real-time assessment of cyber security threats” and “generate actionable reports/alerts for proactive actions” by law enforcement agencies.......

“The NCCC will collect, integrate and scan [Internet] traffic data from different gateway routers of major ISPs at a centralised location for analysis, international gateway traffic and domestic traffic will be aggregated separately....

......Government sources said the government would also involve Internet service providers (ISPs) to ensure round-the-clock monitoring of the Internet, while expertise of other private sector organisations would be utilised when required......

.....Apart from monitoring the Internet, the NCCC would look into various threats posed by cyber attacks....... 
Click here to read more .....

Chinese hacked Obama, McCain campaigns, took internal documents, officials say

By Michael Isikoff
National investigative correspondent

The U.S. secretly traced a massive cyberespionage operation against the 2008 presidential campaigns of Barack Obama and John McCain to hacking  units backed by the People’s Republic of China, prompting  high level warnings to Chinese officials to stop such activities,  U.S. intelligence officials tell NBC News.

....

“There’s been successful exfiltration of data from government agencies (by the Chinese) up and down Pennsylvania Avenue,” said Shawn Henry, who headed up the FBI’s probe of the 2008 attacks as the bureau’s chief of cyberinvestigations. 

Click here to read more ....

Software experts to help govt deal with cyber crimes

To deal with the increasing instances of cyber crime, the Haryana government has decided to engage private information technology (IT) experts.

The state government has decided to constitute special teams possessing professional IT skills to promptly detect and investigate cyber crimes.

......"Investigation of cyber crimes including tampering, intrusion, hacking, morphing and phishing needs high software expertise.......

.....These teams will be stationed at Gurgaon to provide such service to the entire state," a state government's official spokesperson said on Sunday......

Click here to read more ..

Obama’s cyber order mirrors India’s net security framework

....India's top security brass has claimed that the Obama administration came up with an executive order that resembles India's cyber security initiatives after it had failed to get the Cyber Security Bill approved in the US Senate....

...A document issued by security brass of the country, which was reviewed by ET, cites at least 12 instances where the US order mirrors India's cyber security framework that was drafted in 2011. These include setting out a cyber security policy, defining critical infrastructure, information sharing between departments and protection of civil liberties....

.....However, Obama's order is silent on identifying enemy infrastructure. ET reported in December of 2011 about India's cyber security framework, which includes mapping of cyber systems of other countries, including their internet gateways, routers, IT system layouts, and web routing patterns.... 
Click here to read more ....