Online/Digital services and security issues in Nepal

Below paragraph is exactly copied from one of the leading Bank's ATM/E banking form. They transfer the liabilities to the end user/customer. We keep our money/Critical information to the bank not because we get the interest, it is for security, if you cannot take any liabilities, you lack the morality and it does not comply with any standard guidelines. Nepal Rastra Bank (NRB) seriously should issue some directives to correct this nonsense.

"The Bank shall not be liable for any computer/cyber-crimes such as hacking etc. and shall not be liable for any unauthorized transactions and/or any transactions carried out by using illegal and fraudulent methods"

Another screenshot from “A” class bank, one of my friends Pratik Shakya, Bijay Limbu Senihang and Maheshower raised this issue over the twitter.

Fig 1.0 Data protection Clause

We've gone through most of the Banks and they have similar clause. Then we discussed the matter further with the Advocate Mr. Baburam Aryal (Cyber Crime/Piracy), he urged “if the Bank doesn't meet the standard of Information Security (Central bank is responsible for the setting the standard) and theft or breach happens, then Bank is liable for any loss. If consumer's actions led the breach then consumer is responsible. There is trend of shifting liability to consumers. Even, telcos and ISPs include similar term which I found unconstitutional."

So, not only Banks, but other institutions such as telecom service provider, ISPs and such are too into similar practice with consumer rights and data protection rights in least concern. ISPs are also running transparent proxy which gives them to intercept the end user’s traffic until and unless users surf the secure site (https). If they (ISPs) want they can add additional http method (Additional http queries, which is not sent by the end users) to the client’s traffic for their use. Proxy gives you this http rewrite features and there is high possibilities for misuse.

We seriously need guideline (Compliance) to protect our data (Financial/Personal/Critical). In India IT (Amendment Act), 2008 - Section 43A & Section 79, these obligations require companies to provide privacy policies, restrict the processing of sensitive personal data, restrict international data transfers and require additional security measures.

• Privacy Policy – The body corporate, or any person on its behalf, that “collects, receives, possesses, stores, deals or handles” personal information must provide a privacy policy that clearly sets out its practices and policies, identifies any sensitive personal data collected and processed, explains the purposes for which the data is collected and used, discloses specific information in relation to the newly defined category of “sensitive personal data,” and provides for reasonable security practices and procedures.
• Definition of Sensitive Personal Data – Sensitive personal data is now a defined term, although the definition is narrower than had originally been proposed in draft regulations. Sensitive personal data includes physical, physiological and mental health conditions, medical records and history, and sexual orientation.  The definition also includes biometric data, passwords and financial information such as bank account details, credit and debit card details.  Information that is freely available or accessible in the public domain is excluded from the definition of sensitive personal data.
• Restrictions on Data Collection and Processing – At the point of collection of any data, individuals must be made aware of the fact that their data are being collected, the purpose for which the data are collected, the intended recipients of the data and the contact details of both the agency collecting the data and the agency that will retain the data.  Further, all data is subject to a restriction on any processing for secondary purposes.  It must be processed only for the purpose for which it was collected.
• Additional Restrictions for Sensitive Personal Data – The prior written consent of an individual is required before their sensitive personal data may be processed.  Consent may be obtained by letter, fax or email.  The provider of the sensitive personal data must be given the option, at the outset, not to provide data and may withdraw their consent to the processing at any time.  In addition, sensitive personal data may only be collected for a lawful purpose connected with a function or activity of the body corporate, and the collection of the data must be necessary for that purpose.  Sensitive personal data may not be retained for longer than required for the purpose for which it may lawfully be used.
• Rights of Access and Correction – Individuals have the right to review the information about them and to ensure that inaccurate or deficient data is corrected or amended, as feasible.
• Disclosure to Third Parties – Information (including sensitive personal data) may only be provided to a third party with the consent of the provider of the information.  There are exceptions where the disclosure has been agreed to contractually, is required for legal compliance purposes, or where the disclosure is to government agencies mandated to obtain the information for specific purposes.  The body corporate processing the information (or any person on its behalf) may not publish it and any third party recipient is prohibited from further disclosing the information.
• International Data Transfers – A body corporate or another person on its behalf may transfer sensitive personal data or information to another body corporate or person in India or abroad where the same level of data protection is assured.  The Rules also stipulate that “the transfer may be allowed only if it is necessary” for the performance of a lawful contract with the provider of the data or with their consent.
• Security – The Rules state that a body corporate will be taken to have complied with reasonable security practices and procedures where they have implemented those practices and have a comprehensive documented information security program and policies that contain managerial, technical, operational and physical control measures commensurate with the information assets and nature of the business.  In the event of a security breach, the organization must be able to demonstrate that it has implemented its documented security control measures when asked to do so.  An organization that has implemented International Standard IS/ISO/IEC 27001 or an approved industry code of practice is deemed to have complied with reasonable security practices and procedures, provided that compliance with the standard or code of practice has been audited annually. (Kennedy, N.India: Privacy of Client Data - Center for Financial Inclusion)

In Addition, The Banking Code and Standards Board of India – Code of Bank’s Commitment to Customers, has the strong privacy framework, which ensure the privacy of the customer. We can even adopt the same framework and make the necessary changes as needed. Our Financial Institution must implement the PCI/DSS framework, which gives the details set of task/guidelines to protect the card/online users. It’s not that financial institution are not aware of these framework, they just lack in willpower. Until NRB doesn't issues the directives, no institution starts implementing. It is the high time to change the mindset before it too late. Foreign cyber-criminal/online scammers are already targeting our bank, recent few incident is the evident that tells banking network are vulnerable and exploited easily.

Privacy is the BASIC RIGHTS of every citizen