21/02/2018
I would like to narrate a real experience that someone, whom I'm closely related to, had to undergo and then I want to ask some very relevant questions.
Person A received a call from an unknown number late at night and the caller threatened that he'd release morphed/obscene photos of her online. He said he knew where she worked, how she used to dress up, whom all she used to hang out with and almost all the details were correct. Needless to say, person A panicked. After a series of torturous nights a headway was achieved and the caller was identified as a coworker of the person A. He had absconded with the company's list of phone numbers of employees, the one he had access to.
This person, the absconder, was very keenly interested in drawing the best out of that database.
Some questions:
1. Had the database contained holistic and comprehensive details of the employees, such as their bank account numbers, their biometric informations, their previous travel details and some random stuff, would it have been more dangerous or just about the same?
2. Have you ever received calls from people who actually KNOW what all loans you currently have (car loan, for example), what all insurance products you have, which all credit cards you use and stuff?
3. If you have, does it ever bother you? Or you never take them seriously?
4. Would you take them more seriously if they had access to your holistic details and were even threatening you?
As an eye opener, you must know that there's a category of customers called the WEALTH CLIENTS. These are, you guessed it, wealthy clients. They have dedicated relationship managers with the banks. These RMs not only manage their service requests but they also pitch their clients financial products. The clients are sometimes amazed as to how the RMs can pitch them those very products that their current financial conditions makes them capable of. And other times they can be seen furious as to why their RM is using their financial data to draw inferences.
The RMs, as you must have understood, have access to literally every single financial data of their clients, everything at one place. You can call somebody up and be like Hey sir your Rubyx card is expiring 35 days from now, would you want a Sapphiro? Or Hey ma'am your FD worth 40 lakhs is maturing in 5 days, I say you put it into PMS.
Can the RMs fetch good price by selling this data? A windfall. They don't do it because they usually are humans of scruples.
The Aadhar data in its current form is as holistic as you can imagine, its access on an if-need-be basis with entities and people you won't ever be able to judge scruples of.
Unfortunately, for most people, the debate is only about the right to privacy and social benefit to the masses. Where is the security? For me it's not about privacy. For me matters like right to pre-natal s*x identification and abortion based on s*x determinism are more important in the privacy debate. I need security.
And don't even think of defending the government apropos the required security. The government is formed by the elderlies who don't understand the fundamentals of cryptography and network security, be it the politicians or the bureaucrats. A school-kid can teach them as to how to tap into your neighbor's Wi-Fi. Their understanding about the gravity of the underlying is an absolute zilch and this I've figured from the numerous debates and news reports on the issue.
Our IT Act cannot tell what e-commerce is. It cannot tell what a blockchain technology is. It can't tell the difference between Uber and Meru. Do we have a National Digital Policy?
Any software or electronics graduate with proclivity to security would agree that an unbreakable code is a mathematical impossibility.
And here we are, our digital lives being either forced or regulated by a generation that understands them the least.
Do we even have an Indian Computer Services Examination to hire software or electronics graduates who understand these issues? Do we have proper infrastructure and tech-savvy custodians?
And people believe that our data is safe with the government.
