Cyber Due Diligence For Banks In India

Cyber security of banking sector is an area that must be taken very seriously by banks of India. Cyber risks for banking industry in India are increasing at an alarming rate. Whether it is phishing scams, spam frauds, Nigerian frauds, ATM frauds or credit card cloning frauds, Indian banking industry is not prepared to tackle them.

Realising the gravity of the situation, the Reserve Bank of India (RBI) has recently released a report of its working group on information security, electronic banking, technology risk management, and cyber frauds.

The report has also issued many recommendations that Indian banks would be required to follow in order to provide safe and secure technology driven banking. Practically, this means that banks in India would be required to adopt techno driven and cyber law related due diligence requirements.

Till now banks have not taken due diligence requirements seriously. Already many cyber law related contraventions adjudication proceedings have started in India. The trend is going in the direction of more such consumer disputes and adjudication proceedings in India.

A major reason for this apathy on the part of banks for due diligence is lack of awareness regarding provisions of cyber law of India. The information technology act, 2000 (IT Act, 2000) clearly mandates observation of due diligence on the part of banks. In the absence of such due diligence, banks can be held liable for consumer losses.

Banks must establish core IT committees as per RBI directions that must consist of good techno legal professionals who can guide them regarding various due diligence requirements under the IT Act, 2000 and other laws.

Indian Cyber Law Must Be Scrapped

Many techno legal experts of India are saying that cyber law of India is in bad shape and it deserves to be repealed. For instance, according to Praveen Dalal, managing partner of New Delhi based IP and ICT law firm Perry4Law and leading techno legal expert of Asia, the Information Technology Act 2000 is more on the side of a collection of “Legal Jargon” than a Law as contemplated by the Constitution of India and it deserves an urgent repeal.

Technology related laws are the need of hour these days. The more technology has become a part of our daily lives the greater is a need to regulate it use in a legal manner. Deviance from lawful use of technology often results in cyber crimes. However, legal enablement of ICT systems in India is still missing.

In India cyber crimes and nuisance like spam communication are increasing at an alarming rate. However, the laws required to tackle the same are missing in India. For instance, the information technology act, 2000 (IT Act, 2000) is the sole cyber law of India.

It was amended by information technology act, 2008 (IT Act, 2008). This amendment also made almost all the cyber crimes bailable, giving enough incentives to commit cyber crimes in India without any fear of law or punishment.

Recently, telecom minister Mr. Kapil Sibal showed his intentions to frame rules under the IT Act, 2000. What is not understandable is why he is lingering with this weak and ineffective law? Why cannot he start an exercise of repealing the present cyber law and enacting comprehensive laws regarding cyber crimes, cyber security, e-governance, e-commerce, etc?

The present approach and attitude of Mr. Sibal is piecemeal in nature that can never give an enduring and strong solution against growing cyber crimes in India. It is high time for him to repeal the present cyber law of India and come up with a good one.