Cyber Review - August 2023

National

With an outlay of ? 14,903 crore, the Cabinet approved expansion of the “Digital India” programme.

The Union Cabinet chaired by Bharat’s Prime Minister Narendra Modi, on 16 August 2023, approved the expansion of the ‘Digital India’ programme, with a total outlay of ? 14,903 crore. The expansion of the Digital India programme would enable some of the following programmes among others:

• Under the Future Skills Prime Programme, 6.25 lakh IT professionals will be re-skilled and up-skilled.
• Under the Information Security & Education Awareness (ISEA) Phase Programme, around 2.65 lakh people will be trained in Information Security.
• In addition to 18 Supercomputers already deployed, 9 more Supercomputers will be added under National Supercomputer Mission (NSCM).
• Three Centres of Excellence (CoE) in Artificial Intelligence (AI) on health, agriculture, and sustainable cities will be established.
• New initiatives in the area of cyber security including development of tools and integration of more than 200 sites with National Cyber

Coordination Centre (NCCC). ^[1]

Bharat’s Digital Public Infrastructure offers scalable, secure, and inclusive solutions for global challenges

In his video address to the G20 Digital Economy Ministers’ Meet on 19 August 2023, Prime Minister (PM) Narendra Modi attributed the remarkable digital transformation that has occurred in Bharat over the last nine years to the commencement of the “Digital India” programme in 2015. Prime Minister Modi emphasised that Bharat’s digital transformation is driven by its unwavering confidence in innovation and dedication to rapid implementation, as well as a spirit of inclusiveness in which no one is left behind. The Prime Minister referred to Bharat’s 850 million internet users, who have some of the lowest data bills in the world. PM Modi spoke about harnessing technology to transform governance and make it more effective, inclusive, speedier, and transparent, citing Aadhaar, Bharat’s unique digital identity programme that serves over 1.3 billion people. ^[2]

“Digital Personal Data Protection Act is set to replace the 22-year-old IT Act”: MoS E&IT

In an interaction with students, start-ups, and prominent people in Bengaluru on 12 August 2023, the Minister of State for Skill Development & Entrepreneurship and Electronics & IT— Rajeev Chandrasekhar charted the course of the Digital Personal Data Protection (DPDP) Act, also known as Digital India Act, from its inception to its present status as a law. “The Digital Personal Data Protection Act is a world-class legislation. On 15 August 2021, our Prime Minister (PM) Shri Narendra Modi introduced the term ‘techade,’ reflecting his vision of a future full of technological opportunities for students, young Indians who will be part of the workforce tomorrow. Looking back to 2010, when I was an MP, I introduced a private members’ bill in the Parliament, asking for privacy to be recognised as a fundamental right. Unfortunately, the government at that time did not feel it was a necessary debate. Essentially personal data of citizens of this country was available for exploitation,” said MoS Chandrasekhar.The 22-year-old Information Technology (IT) Act will be replaced by the Digital India Act. The Digital India Act will address the entire technological ecosystem. Bharat decided to create an indigenous bill from beginning rather than drawing influence from the General Data Protection Regulation (GDPR). “We have looked at the internet with the 830 million Bharatiya who use the internet and by 2025-26 it will be 1.2 billion. We are the largest connected country in the world. We deserve to be setting our own standards in any conversation about technology for the future rather than borrowing anything from the European Union (EU) or the United States (US),” added MoS Chandrasekhar. ^[3]

Bharat to expand digital payments with AI-powered voice transactions.

The Reserve Bank of India (RBI) has proposed incorporating Artificial Intelligence (AI)-driven voice features on United Payments Interface (UPI), to enable digital transactions through voice commands. The move will make UPI more user-friendly and popular. The proposed plan is to enhance the transaction limit for small-value digital payments in offline mode from ? 200 to ? 500 with the overall limit being retained at ? 2,000 per payment instrument to contain the risks associated with relaxations of 2FA (two-factor authentication).

“As AI is becoming increasingly integrated into the digital economy, conversational instructions hold immense potential in enhancing ease of use, and consequently reach, of the UPI system. It is, therefore, proposed to launch an innovative payment mode viz., ‘Conversational Payments’ on UPI,” said RBI Governor Shaktikanta Das on 10 August 2023. ^[4]

International

TikTok removed 284 accounts linked to China’s misinformation syndicate.

Around 9,000 Facebook and Instagram accounts, groups, and pages connected to a Chinese political spam network that had been targeting people in Australia and other countries were purportedly shut down on 30 August 2023 by Meta (previously Facebook). In addition to Instagram and Facebook, Meta’s study uncovered the influence of operation on over 50 online platforms and forums, including X (previously Twitter), YouTube, TikTok, Reddit, Pinterest, Medium, Blogspot, and Livejournal. Positive content about China and Xinjiang province and negative commentary against the United States (US), Western international policy, and critics of the Chinese government, including researchers and journalists, was posted. According to TikTok’s combating influence policy, the organisation focuses on “behaviour and assessing linkages between accounts and techniques to determine if actors are engaging in coordinated efforts to mislead TikTok's systems or our community.” ^[5]

China’s Huawei and Ali Baba are among companies seeking deepfake approvals.

On 01 September 2023, the Cyberspace Administration of China (CAC) published a list of Chinese technology companies, including Huawei and Ali Baba, requesting certification to comply with CAC guidelines governing deepfake technology, which were imposed in December 2022. These businesses are looking for models that can modify visual and audio data.

On 31 August, after getting regulatory authorisation, five Chinese tech businesses, including Baidu Inc and SenseTime Group, debuted AI-enabled ChatBots to the public. Deepfake uses AI technology to create visual and auditory data that is practically indistinguishable from the original and may be easily manipulated or misled. ^[6]

“Cybercrime will cost Germany around Euro 206 billion in 2023,” claimed Bitkom.

Cybercrime, such as theft of IT equipment, data, and digital and industrial espionage, will cost Germany Euro 206 billion in 2023, according to German Digital Association—Bitkom. In a survey of over 1,000 tech companies, Bitkom claimed that the damage will surpass the Euro 200 billion mark for the third consecutive year. “The German economy is a highly attractive target for criminals and hostile states. The boundaries between organised crime and state-controlled actors are blurred,” said Bitkom President Ralf Wintergerst.

Of the companies that suffered cyber-attacks this year, 70 per cent have had sensitive data stolen - an increase of 07 per cent points on the previous year. Similarly, 61 per cent of companies have had their digital communications spied on - up 04 per cent points on the year. ^[7]

AI-enabled ChatBots could carry cyber risks, claimed British officials.

According to British officials, integrating Artificial Intelligence (AI)-driven ChatBots into businesses can be tricked into performing harmful tasks. In a blogpost posted on 30 August 2023, the United Kingdom (UK)’s National Cyber Security Centre (NCSC) claimed that experts had not yet gotten to grips with the potential security problems tied to algorithms that can generate human-sounding interactions- dubbed large language models (LLMs).

For instance, an AI-powered ChatBot deployed by a bank might be tricked into making an unauthorised transaction if a hacker structured their query just right. “Organisations building services that use LLMs need to be careful, in the same way they would be if they were using a product or code library that was in beta. They might not let that product be involved in making transactions on the customer’s behalf and hopefully would not fully trust it. Similar caution should apply to LLMs,” said the NCSC in one of its blog posts, referring to experimental software releases. ^[8]

“In South-East Asia, hundreds of thousands of people are transported to work as online scammers”: UN report.

Highlighted in a report prepared by the United Nations Human Rights (UNHR) office, hundreds of thousands of people are being forcibly engaged by Organised Crime Syndicates (OCS) in cyber-scam in South-east Asia— from romance to investment scams to crypto-fraud to illegal gambling. “People coerced into working in these scamming operations endure inhumane treatment while being forced to commit crimes. They are victims. They are not criminals,” said the UN High Commissioner for Human Rights— Volker Turk.

The magnitude of online scam trafficking in South-east Asia is difficult to assess due to its covert nature and gaps in official reaction. According to estimates, at least 1,20,000 persons in Myanmar may be in situations where they are forced to commit cyber-frauds, with Cambodia accounting for roughly 100,000. ^[9]

Endnotes

^[1] “Union Cabinet approves expansion of the Digital India programme with an outlay of ? 14,903 crore”, Press Information Bureau- Cabinet, 16 August 2023, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1949426 [2]
^[2] “PM addresses G20 Digital Economy Ministers’ Meet”, Press Information Bureau-Prime Minister’s Office, 19 August 2023, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1950321 [3]
^[3] “Digital Personal Data Protection Act is a World-Class legislation: MoS Rajeev Chandrasekhar”, Press Information Bureau- Ministry of Electronics & IT”, 13 August 2023, available from: https://pib.gov.in/PressReleasePage.aspx?PRID=1948357 [4]
^[4]Mishra, Lalatendu. “Soon, AI will let you make a UPI payment using voice”, The Hindu, 10 August 2023, available from: https://www.thehindu.com/business/rbi-launches-conversational-offline-payments-via-upi-raises-upi-lite-limit-to-500-per-transaction/article67179397.ece [5]
^[5]Taylor, Josh. “TikTok removes 284 accounts linked to Chinese disinformation group”, The Guardian, 31 August 2023, available from: https://www.theguardian.com/technology/2023/aug/31/tiktok-removes-284-accounts-linked-to-chinese-disinformation-group [6]
^[6] “Huawei and Alibaba among companies seeking Chinese deepfake approvals”, Reuters, 01 September 2023, available from: https://www.reuters.com/technology/huawei-alibaba-among-companies-seeking-chinese-deepfake-approvals-2023-09-01 [7]
^[7] Martinez, Maria. “Cybercrime to cost Germany 206 billion euros in 2023, survey finds”, Reuters, 01 September 2023, available from: https://www.reuters.com/technology/cybercrime-cost-germany-206-billion-euros-2023-survey-2023-09-01/ [8]
^[8]Satter, Raphael and Martin Coulter. “British Officials say AI chatbots could carry cyber risks”, Reuters, 31 August 2023, available from: https://www.reuters.com/technology/british-officials-say-ai-chatbots-could-carry-cyber-risks-2023-08-29/; [9]
Dave C. “Exercise caution when building off LLMs”, National Cyber Security Centre- United Kingdom, 30 August 2023, available from: https://www.ncsc.gov.uk/blog-post/exercise-caution-building-off-llms [10]
^[9] “Hundreds of thousands trafficked to work as online scammers in SE Asia, says UN report”, Press Release- Office of the High Commissioner for Human Rights, 29 August 2023, available from: https://www.ohchr.org/en/press-releases/2023/08/hundreds-thousands-trafficked-work-online-scammers-se-asia-says-un-report [11]