12008 - Apple’s Refusal to Approve India’s Anti-Spam App Angers Regulators - Bloomberg

Apple’s Refusal to Approve India’s Anti-Spam App Angers Regulators

By Saritha Rai

6 September 2017 3:57:06 PM AEST

Apple Inc.’s refusal so far to approve the Indian government’s anti-spam iPhone app is infuriating regulators, potentially harming the company’s efforts to sell more products in the country. The Telecom Regulatory Authority of India has been trying unsuccessfully to get its Do Not Disturb software included in the App Store. The program lets people share spam call and text message logs with the agency, which uses the data to alert mobile operators to block the spammers. Apple has said the app violates its privacy policy, according to the regulator. The standoff could impact Apple’s efforts to expand in India, where half a billion smartphones will be sold by 2020. The Cupertino, California-based company has been in discussions with India’s government to open retail stores and secure permission to sell used iPhones imported into the country. Apple has put forth a long list of demands, including tax breaks and other concessions, to set up manufacturing facilities.  “Nobody’s asking Apple to violate its privacy policy,” said Ram Sewak Sharma, chairman of the Delhi-based telecom regulator. “It is a ridiculous situation, no company can be allowed to be the guardian of a user’s data.” The regulator is currently seeking public and stakeholder comments on a consultative paper on users’ control over their personal information and rules on the flow of data through telecommunications networks. The process, scheduled to be completed in September, could eventually lead to new rules governing user data. That could also become part of the telecom licensing process, Sharma said. Any new measures could affect not just Apple, but Facebook, Google and other technology companies that handle large amounts of private and personal information. “Data is a strategic asset, and there’s realization around the world that public policy has to come to grips with it,” said Nandan Nilekani, who ran India’s biometric Aadhaar identity program and was recently appointed chairman of Asia’s No. 2 outsourcer Infosys Ltd. Apple didn’t respond to requests for comment on the regulator’s remarks. Last year, the company shipped 2.5 million iPhones in India, and earlier this year, supplier Wistron Corp. began assembling a limited number of iPhones in Bangalore. So far, the Indian government has all but declined Apple’s request to import used iPhones, and has yet to respond to other demands. Sharma, who banned Facebook Inc.’s Free Basics internet access program last year, said there hasn’t been a resolution after half-a-dozen meetings with Apple. While Apple’s policy allows it to share user data with affiliates and strategic partners, the Indian government’s Do Not Disturb app only requires a limited, pre-approved level of data sharing, said Sharma, who has a degree in computer science from the University of California at Riverside. Apple’s policy states that sharing data with any other entity isn’t allowed. “The problem of who controls user data is getting acute and we have to plug the loose ends,” Sharma said. “This is not the regulator versus Apple, but Apple versus its own users.”

11949 - Forget Aadhaar, there's a bigger privacy risk you have already taken - Economic Times

Forget Aadhaar, there's a bigger privacy risk you have already taken

BY ECONOMICTIMES.COM | SEP 01, 2017, 05.00 PM IST

The Centre has directed 30 smartphone makers to inform it about the procedures they follow to ensure the security of mobile phones sold in India.

Those who protest against Aadhaar, the 12-digit biometric identification number, due to privacy concerns and risk of data theft, may have missed the elephant in the room — the smartphone. Indians run a bigger risk of data theft and loss of privacy through their smartphones. 

India's former union home secretary Rajiv Mehrishi has flagged this concern which does not evoke enough debate. Mehrishi, who retired as Union Home Secretary on Thursday, told a parliamentary panel last month that 40 per cent of people who use smartphones and top applications, knowingly or unknowingly, share data with the entire world including the Central Intelligence Agency (CIA) of the US, according to a report in The Indian Express. 

Mehrishi made this remark on July 21 when he appeared before the Parliamentary Standing Committee on Home Affairs, according to the report. 

Mehrishi said fingerprints and biometrics were being captured through smartphones. 

Before Mehrishi's made this statement, Wikileaks had claimed to have exposed CIA's humongous hacking programmes. In March, Wikileaks released a data dump which it claimed were Central Intelligence Agency (CIA) tools used for hacking into smart devices. The software targeted by the hacking tools included Apple’s iOS and Google’s Android. 

There is a growing awareness about security issued related to smartphone apps. 

Recently, the Ministry of Electronics and IT directed 30 smartphone makers to inform it about the procedures and processes they follow to ensure the security of mobile phones sold in India, following reports of data leakage and theft. 

The smartphone makers, which include global players such as Apple and Samsung and Chinese makers such as Oppo, Vivo, Xiaomi, Lenovo and Gionee, besides home-bred ones such as Micromax, have been asked to provide details about security practices, architecture, frameworks, guidelines and standards followed for providing secure transmission and storage of data. 

The government is finalising cyber security standards for mobile phones. 

According to a recent study by IMDEA Networks Institute of Spain, more than 70 per cent of smartphone apps are reporting personal data to third-party companies like Google and Facebook 

When a smartphone user installs a new app, it asks for the user's permission before accessing personal information. While some of the information collected is required for the app to run, apps can get access to more information than actually required or the required information is used for purposes that violate privacy. For example, third parties can even get to know and track your location and find out what you are doing at a particular moment.

10516 - Microsoft willing to extend Skype for Aadhaar authentication - Biometric Update

Microsoft willing to extend Skype for Aadhaar authentication

By Rawlson King

October 3, 2016 - 

Microsoft has presented various “case scenarios” to the Indian government on how Skype can be used for identity authentication using Aadhaar.

Aadhaar is the 12-digit unique identification number issued by the Indian government to every individual resident of India. The Aadhaar project aims to provide a single, unique identifier which captures all the demographic and biometric details of every Indian resident. Currently, Aadhaar has issued over 900 million Aadhaar numbers, and has enrolled approximately 850 million people, with a goal of ultimately enrolling 1.28 billion people.

The program, governed by the Unique Identification Authority of India (UIDAI), is currently used to authenticate delivery of social services including: school attendance, natural gas subsidies to India’s rural poor, and direct wage payments to bank accounts. The system also provides identification to people who do not have birth certificates.

According to several published reports, UIDAI is in talks with Microsoft for embedding the identification technology onto its mobile devices. Earlier this month, BiometricUpdate.com reported that Indian government officials invited executives from Apple Inc., Microsoft Corp., Samsung Electronics Co. and Alphabet Inc.’s Google to discuss the integration of Aadhaar with their various mobile technologies.

While Apple offered a negative response concerning mobile integration, reports have noted that Microsoft is willing to partner with the Indian government on Aadhaar and other identity authentication projects.

Microsoft India Chairman Bhaskar Pramanik told media sources: “We have presented various case scenarios on how Skype can be used. We already support iris authentication on Windows 10. Now it depends on them how they want to proceed.”

Advertisement

According to reports, the global software giant has already partnered with the Andhra Pradesh state government in testing a pilot project designed to reduce high school dropout rates. 

Using data analytics, the solution predicts how many students will drop out of school, helping teachers make better decisions to curb the problem. Microsoft notes it will extend the program to Punjab and is also discussion with other states to extend it elsewhere through India.

Microsoft is also reported to have established another pilot project that assists farmers to obtain SMS notifications on when is the best time to sow seeds, so that they can obtain the best yield.

By taking the position to work with the central and state governments, Microsoft is positioning itself to participate in the estimated, multi-billion dollar Aadhaar third-party marketplace.

9437 - Editorial: Guarding Aadhaar data - Financial Express

Editorial: Guarding Aadhaar data

Don’t have a backdoor for disclosing biometric data

By: The Financial Express | March 4, 2016 2:28 AM

Given the fears raised by various privacy advocates, the Aadhaar Bill has done well to categorically say “no core biometric information, collected or created under this Act shall be shared with anyone for any reason whatsoever or used for any purpose other than generation of Aadhaar numbers and authentication under this Act”.

Given the fears raised by various privacy advocates, the Aadhaar Bill has done well to categorically say “no core biometric information, collected or created under this Act shall be shared with anyone for any reason whatsoever or used for any purpose other than generation of Aadhaar numbers and authentication under this Act”. 

That, indeed, was what Aadhaar was meant for—a way to ensure there was no theft in, say, subsidised rations and that these were delivered only to those whom they were meant for. 

As the database developed, other innovative uses for it were discovered like eKYC, DigiLocker, money transfers and, by all accounts, there is another lot of innovation waiting to be built upon this database.

The clauses that allow information to be shared under certain circumstances, however, need a closer look as it appears they can be abused.

 As in all such cases including phone tapping, the Bill says a court order will be required for sharing of information either in response to some police case or when national security demands it. This is where the potential problem comes in, more so since a district judge’s order is considered good enough.

 If data is sought on, say, whether a person used his Aadhaar biometrics at a particular location—‘authentication records’, in jargon—that may still be permissible, though with very strict checks. But a plain reading of Section 33(2) suggests that the information that can be revealed includes ‘identity information’ which, in the section on definitions, is said to include a person’s ‘Aadhaar number, his biometric information and his demographic information’. 

This is clearly a drafting lapse since the last thing the government wants is to have backdoors that allow biometric information of people to be accessed by anyone, including intelligence agencies—vital as national security is, Aadhaar is not meant to be a substitute for a fingerprint database of criminals or a crutch around which a case against a terrorist can be built. 

Indeed, Apple’s contention in its fight with the FBI over breaking into a terrorist’s phone is precisely that once a backdoor is created, there is no saying who else will enter it. Aadhaar can be used to bring about many productivity-enhancing changes, but they all revolve around the database being impenetrable. By anyone, at any time.

9384 - Tech giants unwilling to link biometrics to Aadhaar - Biometric Update

Tech giants unwilling to link biometrics to Aadhaar

By Rawlson King

February 22, 2016 - 

Officials in the Indian government claim that Apple, Microsoft and Google are not making their proprietary biometric systems available to be used for Aadhaar authentication. The officials claim that these companies are acting as “gatekeepers” and are averse to allowing open access to their smartphone software development frameworks to leverage biometric functionality.

Aadhaar, recognized as the world’s largest universal civil ID program and biometric database, is currently used by the Indian government to provide social services. To date, Aadhaar has issued over 900 million Aadhaar numbers, and has enrolled approximately 850 million people, with a goal of ultimately enrolling 1.28 billion people.

With wider enrollment, government officials predict that Aadhaar will become a platform for financial transactions since the Indian government has proposed use of Aadhaar to issue bank accounts to all Indian households.

The government has also committed to expand the use of Aadhaar for social services, implementation of a universal healthcare scheme, along with enhanced monitoring of government employee attendance and truancy. The government has also proposed using Aadhaar for private sector employment ID validation, along with national security and crime-related surveillance applications.

Unnamed government officials told the Indian Express that they are dissatisfied with stance of the tech companies because while not everyone has a credit card, nearly everyone in India has a mobile phone that can enable financial transactions.

“The mobile number that you have for the phone is ‘what you have’. A phone is one factor of authentication. There are ways to confirm that this mobile number is yours, for instance through mechanisms such as “one time password”. The second factor of authentication is the biometric, which can be an iris scan or a fingerprint. India’s Aadhaar is unique in the world, and can make the mobile instrument provide a two-factor authentication for online transactions,” an official said.

A problem emerges, however, if smartphone developers are uncooperative and do not allow their software frameworks to interact with other authentication systems such as Aadhaar. An uncooperative stance means that software developers must seek alternative middleware alternatives to link Aadhaar to existing and ubiquitous phone platforms including Apple iOS and Google Android.

9379 - User Authentication: Tech majors spurn move to link Aadhaar with biometrics - Indian Express

User Authentication: Tech majors spurn move to link Aadhaar with biometrics

Step can potentially replace multi-factor authentication for secure transactions.

Written by Anil Sasi , P Vaidyanathan Iyer | New Delhi | Published:February 19, 2016 1:53 am

Global technology companies such as Apple, Google and Microsoft have so far fobbed an attempt by the Government of India to let their proprietary software allow matching of a user’s fingerprint or iris scan as captured in the mobile instrument with his or her biometrics as stored in the Aadhaar database.

If allowed, this will let a smartphone user to electronically undertake myriad financial transactions. The biometrics on the phone can potentially replace multi-factor authentication for credit cards and other such secure transactions by offering two-factor authentication at the click of a button.

According to senior government officials, companies such as Apple, Google and Microsoft are acting as “gatekeepers” and are averse to allowing open API (application programme interface) that facilitates programmatic access to a proprietary software application.

- See more at: http://indianexpress.com/article/business/business-others/user-authentication-tech-majors-spurn-move-to-link-aadhaar-with-biometrics/#sthash.9YT2hMjT.dpuf