Leather Wallet to Mobile Wallet: Legal Challenges

BY Ashish R. Aggarwal.

Banking to Payment banking is gaining pace. And except for the elite class of politicians and alike (who do not like change), people are embracing the idea gradually. But there is a saying (which, incidentally, is an eternal truth as well) after every bright morning, follows a dark night. On one hand when a cashless economy will benefit us in multiple ways, on the other hand cyber financial crimes will increase. It is not that cyber financial crime is not present now. The truth is that India being a cash-based economy, the chances of digital crime were low. With the increase in digital transactions, cyber criminals will enter their dream time – their hey day. More and more technologically challenged people will become their victims. Payment banking can lead to a war on black money and corruption.

Genuine or new hypotheses of shortage of new notes: An attempt by the government to keep the supply of new notes tight for various reasons. If it is a deliberate attempt to keep the tight supply of new notes, this may be attributed to either: a) to curb illegal conversion of old currency to new currency by various vested interests such as black money holders, politicians or terrorists; OR b) denying disruptive forces to pump counterfeit currency in the Indian economy; OR c) forcing people to opt for cashless digital transactions (CDT); OR d) any partial/full mix of all these three.

Implementing cashless digital transactions (CDT) is not easy. It has challenges including and not limited to vested interests, resistance to change, awareness, risk, cost and legal. In these, the resistance by vested interests and to change are mostly political, whereas others are technical and legal. Barring a few exceptions (just to save me of prejudice), almost all IT infrastructure of all transaction service providers will fail on basic cyber security testing criteria like Confidentiality, Integrity, Non-repudiation, Incident response and Customer protection functionalities for CDT.

Internet banking applications are not tested for many customer oriented risks and vulnerabilities such as man-in-the-middle malware, business intelligence, information leakage, etc. In some cases, it is seen that even very basic requirements are missing. For example, SSL/TLS is not used; password storage in browser is not blocked; autocomplete is enabled; cookie is not secured; security patches are not applied, to name a few from a long list. Having security vulnerabilities such as SQL-Injection, Cross Site Scripting (XSS), CSRF, unsafe session hijacking, etc. is another major concern. These vulnerabilities are hackers’ gateway to compromise the user demographic, logon and data. Any compromise violates the basic cyber security like confidentiality, integrity, etc. and exposes the citizen to risk of various losses including and not limited to financial, regulatory, credibility, image, identity hijack, etc.

Very limited web-portals are rigorously tested for cyber security vulnerabilities. The truth is that India majorly being a cash-based economy, the chances of digital crime were low. With the increase in digital transactions, cyber criminals will enter their dream time – their hey day. More and more technologically challenged people will become their victims. Similarly, in mobile apps, very few apps are rigorously tested (apart from transaction load) for cyber security criteria like Confidentiality, Integrity, Non-repudiation, Incident response and Customer protection functionalities for CDT. Examples exist that the app is made available without even complete security testing like the NaMo app, which is a basic and simple app for online voting.

In unsecure apps and lack of cyber security awareness in developers/programmers, the sessions do not end after a transaction or after a specified time, thus the risk of user hijacking exists. The current status is that the user education is extremely low up to the extent that it is almost nil or non-existent. With my sample size, I have seen that even most of the operational bankers in branches have limited or no education about cashless digital banking/transactions. The Branch IT Manager refers the person to some other department to resolve any issues in CDT!

Another aspect of user awareness is language. Almost all apps, data to fill, are in English which is used by a miniscule minority. Further, how many understand the “how to install” or FAQs given on websites of banks? All user instructions and awareness data must be in local languages using different video/multimedia through various modes and channels. The user must get clear educational data, either written or visible and/or audio instructions and guidance, just by pressing a help icon (similar to F1) at every step, while using the app.

Many of the laws, rules, and guidelines of modern banking were framed when there was no IT. These laws need a radical overhaul in a digital environment. The nearest law is Information Technology Law (say IT Act 2000, amended in 2008). Further, in case of crime/fraud, recognizing and collecting evidence is radically different in a digital environment compared to paper based. In a physical transaction, the evidences are paper based. Thus, physical hard copy evidence exists. Creation of chain of custody is established and laws support this. The analysis of paper-based evidence is an established science. In a digital environment, many times logs are unavailable or deleted or corrupted or tampered; the storage is deleted or tampered; evidences are scattered over places/jurisdictions, in some cases even in other countries; laws to define and accept digital evidences do not exist.

The 1st challenge will be to create and ensure robust and reliable backend IT infrastructure, WAN and last mile connectivity with defined and tested quality parameters. The quality parameter of the whole infrastructure setup must be a reliable transaction within a specified time of say 2 seconds when the peak load will be from 50-60 thousand transactions per second. In any cash transaction, the cost of transaction to both payee and payer is NIL. The transaction cost is incurred by the government through RBI. RBI prints currency, stores currency in currency chests, moves it to banks, collects back, stores, and destroys mutilated/returned/demonetised currency. Cost is borne by RBI for all these activities. This cost includes direct cost, indirect cost and overheads for all these activities. I am not considering opportunity cost because cash has been a mandatory activity for our economy. Now, in a CDT environment, cash transaction cost will be reduced, so opportunity cost or part of the total cost may be considered, but let us ignore it for this paper.

Cyber Security is another serious challenge and concern which can make or break the CDT mission. Current service providers including banks, payment gateways, e-commerce companies, etc. do not guarantee cyber security to either the cashless digital payer or payee. Cyber security can be defined as achieving a minimum of basic security criteria including:

e) Assuring Non-repudiation of person and/or transaction

f) Maintaining Incident response with defined service level parameters and;

g) Availability of Customer protection functionalities in IT infrastructure

These and similar issues need to be addressed before courts will be further loaded with CDT related cases over and above existing 3 crore pending cases. The appeal is filed with the Cyber Appellate Tribunal at Delhi, which is not functional for the last 5 years. Both these remedies are created under the IT Act 2000. Normal civil courts have no jurisdiction in cases related to cyber frauds. What is the remedy open to a cybercrime victim citizen?

Further, there exists no cyber liability law in India. For banks, RBI has published a draft “limiting liability of customers in unauthorised electronic banking transactions” circular on 11 August 2016, for comments by 31 August 2016. Even after 3 months, this notification is still pending and citizens are not protected. It is speculated that this delay may be due to lobbying by banks.

Another legal challenge will come in a cash environment where transactions are considered valid. Will a similar act of partial/full payment, done by CDT, be considered binding and valid? As per existing laws, in case of fraud, the user is mostly held responsible for the crime, if not proved otherwise. This burden of proof is totally absurd for a normal citizen, in a CDT environment. Currently there is no protection to a citizen, in case of cyber fraud where the citizen is a victim and not responsible for the crime. As per IT Act 2000, all cyber-crimes/frauds are to be adjudicated by the Cyber Adjudication Officer, who is mostly Secretary/Principal Secretary of the IT department of the respective state. Currently, most of the Cyber Adjudication Officers are not working or resolving the grievances.

Thus, the required laws must be created and existing laws must be amended, with due checks and controls, to make CDT legally valid. The citizen must be protected from losses in case of loss of money/data or privacy. It can be done using cyber liability laws and limiting the liability of the citizen with defined caps. Like DICGC or similar bodies, it can be encouraged to underwrite these losses at a predefined premium. Adjudication processes must be activated and function in a time-bound manner. It may require creating full-time Cyber Adjudication Officers, who can be appointed other than state IT Secretaries.

Other legal issues exist which need addressing. This may require one or more bills in parliament. This can be part of a money bill, thus requiring passing by Lok Sabha only. CDT must be implemented in mission mode. A separate nodal officer or CEO at PMO/RBI will have powers to take action and bypass bureaucratic red tape. His performance must be measurable and visible.

Internationally, cash has become a key target in the fight against terrorism. Where intelligence can take action by knowing where terrorists keep their cash, the military can strike and destroy those locations and put a dent in the terror groups’ ability to operate. In January, the United States bombed a building that served as a “cash and distribution center” in Mosul, Iraq. The strike destroyed “millions of dollars” in cash. While it didn’t bankrupt the group, it put a significant dent in the Islamic State group’s ability to operate like a state. The U.S. pledged to continue such strikes. Had the money been in a bank account somewhere, military planners would be unable to take action in this way.

But the attacks on banknotes are misguided and ignore the reasons why they are ubiquitous and necessary. Large holdings in cash should be seen as the safest store of wealth, not as a payment instrument of the past. If you are a serious criminal, you avoid using cash. You’d rather hide your money in an offshore bank account than store large stashes of banknotes that are difficult to transport, conceal and use without detection. Cash confiscation is difficult for law enforcement.

Cash has demonstrated its worth in times of crisis. When natural disasters knock out electrical grids for days or weeks, cash is a saving grace for purchasing essential supplies. During the global financial crisis following the collapse of Lehman Brothers in late 2008, cash became a safe haven for anxious depositors. Australia’s Reserve Bank saw a 12 percent rise in demand for banknotes in late 2008 thanks to an increase in hoarding.

Large denominations of banknotes are difficult to transport, conceal and use without detection. Cash confiscation is a challenge for law enforcement. If you are a serious criminal, you avoid using cash. You’d rather hide your money in an offshore bank account than store large stashes of banknotes. Cash has demonstrated its worth in times of crisis. When natural disasters knock out electrical grids for days or weeks, cash is a saving grace for purchasing essential supplies. During the global financial crisis following the collapse of Lehman Brothers in late 2008, cash became a safe haven for anxious depositors. Australia’s Reserve Bank saw a 12 percent rise in demand for banknotes in late 2008 thanks to an increase in hoarding. Internationally, cash has become a key target in the fight against terrorism. Where intelligence can take action by knowing where terrorists keep cash, the military can strike.