26 Dec 2023 : The Indian Express

Topic 1 : Safety and Cybersecurity

Introduction: In October, Resecurity, a US company, informed the world about the availability of Indians’ personal data on the dark web.

What did the leak include?

The seller of the data set was providing verifiable, sensitive information of 55 per cent of the Indian population — roughly around 815 million (81.5 crore) citizens.
This included personally identifiable information like name, phone number, Aadhaar number, passport number and address.
All for a paltry sum of $80,000.

Recent examples of data leaks in India

Earlier in the summer, multiple reports surfaced about a leak that exposed the personal information of individuals registered on the CoWin website.
Last year, in November, Delhi’s prestigious AIIMS had to work with pen and paper to register a sea of patients after a ransomware attack.
Data breaches are at an all-time high in the world. Yet, some countries are more vulnerable than others.

What makes the data breach of October dangerous?

Thieves who have stolen names, Aadhaar numbers and passport information can use that information not only to sign up for new accounts in the victim’s name, but also to commit tax identity theft, online-banking theft and other financially motivated scams.
We are already seeing a rise in cyber frauds, with people losing their life savings, taking on debt and suffering shame and stigma for having been scammed.
As per the World Bank, “India is one of the fastest growing economies of the world and is poised to continue on this path, with aspirations to reach high middle income status by 2047”.
Our mobile phone usage, enhanced banking access and the ever-growing market size that generates enormous amounts of data not only makes us attractive to companies but also to bad actors.

Limitations of India’s data security measures

When such instances happen, the Computer Emergency Response teams spring into action and impacted users are informed and educated about what steps they can take to reduce the chance that their information will be misused.
Basically, a near-term and a long-term plan is devised and executed.
This is “Incident Response”. These strategies and tactics have been instrumental in reducing the impact of data breaches.
In India, all we see are denials, semantic hand waving and some incomprehensible word salads from ministers, rinse and repeat.
Citizens are never informed about the leak of their personally identifiable information or educated about any recourse.
They are left to their own devices until the next breach happens.

Aadhar data and its security

Despite a crystal-clear prohibition issued by the Supreme Court against making Aadhaar registration mandatory, the central government and enthusiastic parties in both state governments and industry proceeded to adopt Aadhaar-based technology and impose requirements for Aadhaar registration for social services and benefits.
By making Aadhaar registration mandatory, the government imposed on every Indian citizen an unmanaged risk of digital environment catastrophe.
The constant flow of news about data breaches, whether at Comcast or UIDAI, is normalising massive losses of personal data.
Despite all the puffery and all the claims about how Aadhaar makes India a world leader, no one has so far intimated how we are managing the obvious harms that are plaguing our society.
From Brookings to Moody’s to the CAG, everyone has called out UIDAI on its failure to properly regulate its client vendors and address security, lack of transparency and accountability.
The plan cannot be for perfect security, operating flawlessly forever, for Aadhaar.
No government can, at present, promise perfect security for even its most critical personnel data.
No “platform” company, with all the immense profits can claim to guarantee perfect security of customer data.
No Indian citizen can, or should, trust a story in which Aadhaar data security is never breached because breaches do occur regularly.

India’s new Data Protection Act and its inadequacy in data protection

India’s recently introduced Data Protection Act does nothing to address sensitive health information.
Under Clause 17(4), in fact, the government is exempt from provisions of data retention and erasure of personal data.
Unless that data can make a difference in making a decision about a data principal, right to correction, completion and updation is also not available.

What should government do to improve data protection in India?

Make the prevention, detection, assessment, and remediation of cyber incidents a top priority.
Recognise the importance of digital infrastructure as essential to national and economic security of the population.
Make the state digital infrastructure trustworthy by increasing transparency and accountability.
A cyber security board should be established with government and private sector participants that has the authority to convene, following a significant cyber incident, to analyse what happened and make concrete recommendations for improving cybersecurity.
Adopt a zero-trust architecture, and mandate a standardised playbook for responding to cybersecurity vulnerabilities and incidents.
Urgently execute a plan for defending and modernising state networks and updating its incident response policy.
Finally, put people at the centre of all policies. Informing them immediately, helping them protect themselves and remediate fallout from cyber incidents should be the government’s responsibility.

Conclusion: We want a Digital India. Just not the Digital India we are living in at the moment. For that to materialise India needs a robust Data Protection measure that puts people at the centre.

Topic 2 : Look beyond headline numbers

Introduction: The second quarter GDP growth estimate, despite its statistical quirks, surpassed even the most optimistic of projections. It also seems to have reaffirmed the more cheerful medium-term projections of the Indian economy. Yet, beyond the headline growth numbers, there are some glaring contradictions in the economy.

What are the concerns in India’s growth trajectory?

Small growth in new jobs despite good GDP growth numbers:

First, it should be a matter of concern that this seemingly healthy economic momentum has, so far, not translated into a commensurate increase in more productive employment opportunities for the millions entering the labour force every year.
With each passing year, the employment challenge is only becoming more severe.
To provide some perspective: India’s workforce rose from around 460 million in 2017-18 to roughly 560 million in 2022-23 — an increase of 100 million workers over a five-year period.
But, during this period, employment in the more productive manufacturing sector grew by just a shade above two million on average each year, while in the less productive agriculture sector, it rose by more than eight million. (The absolute numbers are based on population projections).

Quality of new job produced:

Second, not only were seven of 10 new entrants to the workforce self-employed, but almost seven of the 10 new entrants were also women, with a greater share from rural areas.
These new entrants were more engaged in small establishments or as unpaid helpers in household enterprises, and not in regular salaried or casual wage employment.
Notions of empowerment via self-employment ring hollow considering their meagre earnings.
Not only have real incomes (adjusting for inflation) of self-employed women in rural areas barely risen, but they actually earn less compared to others.
For instance, during April-June 2023, the average gross earning of self-employed females in rural areas was Rs 5,056 during the last 30 days.
In comparison, for males it was Rs 13,831. For the regular wage/salaried female employees in rural areas, the average earning (during the preceding month) was Rs 13,825, while for males, it was Rs 17,274.
Alongside this increase in self-employment, there has also been a steady rise in demand for work under NREGA.
The number of individuals working under the scheme rose from 7.5 crore in 2017-18 to 8.75 crore in 2022-23, and has so far touched 7.38 crore this year, with women increasingly accounting for a greater share of person days of work.
These trends suggest that not only is the rise in female workforce participation possibly an outcome of financial distress, but they also point towards the limited options available for more productive jobs.
It is worrying that such trends have persisted despite growth firming up.

The rise in unsecured personal loans of households:

Third, perhaps a consequence of limited job opportunities, of strained incomes, is the surge in households availing unsecured personal loans.
The loans availed could have been to meet their consumption needs and/or for financing self-employment activities.
As per RBI data, outstanding unsecured personal loans of banks rose from Rs 10.5 lakh crore in March 2022 to Rs 13.3 lakh crore in March 2023, and by September 2023 had touched Rs 14.5 lakh crore.
To put this growth in context: In September 2023, just the personal unsecured loan book of banks, not the entire retail loan portfolio, was equivalent to 42 per cent of total outstanding loans to industry, up from around 33 per cent in March 2022.
And this does not include loans by NBFCs. This increase in such loans has been so rapid that the RBI has been forced to take action to slow down its pace, to obviate problems for the financial sector.
While some signs of stress are visible, hitting the brake hard on these loans, as what seems to be happening, could have implications for household incomes and consumption.

Lack of growth in private sector investment:

Fourth, it should be equally concerning that despite this steady economic momentum, the massive ramp-up in public sector capex, the PLI scheme, and healthy bank and corporate balance sheets, there are indications that private sector investments remain uneven, and have not revived to the extent hoped.
In fact, as per CMIE, new investment project announcements plunged in the September quarter.
And, as per the RBI’s October monetary policy report, investment activity in the first half of the year “drew strength mainly from government capex”.
The “crowding in” has so far failed to materialise.
What has picked up is investments in physical assets (real estate) by the relatively more affluent households.
This can be inferred from the bank credit numbers.
Housing loans outstanding rose from Rs 16.8 lakh crore in March 2022 to Rs 19.36 lakh crore in March 2023, and by September 2023, had touched Rs 20.53 lakh crore.
To provide a frame of reference: The housing loan book was equivalent to 59 per cent of the industrial loan book of banks in September 2023, up from 53 per cent in March 2022.
And this also does not include NBFCs. As the household sector accounts for roughly two-fifths of all investments in the economy, it could have played a part in driving up the investment rate during this period.

Conclusion: This combination of a rapidly growing workforce, where new entrants are more reliant on less productive forms of employment in the least productive sectors, and an investment cycle that is more dependent on governments and households than the corporate sector, calls for a more measured, nuanced assessment of the country’s growth prospects.