Why is it in the news?

• The news of an American cybersecurity company, Resecurity, uncovering the sale of personally identifiable information (PII) of 815 million Indian citizens on the dark web, including sensitive data like Aadhaar numbers and passport details, raises significant alarms.
• However, the specifics on how threat actors like pwn0001 and Lucius accessed this sensitive data remain undisclosed. The stolen PII can be exploited for various cybercrimes, including online-banking theft and tax fraud.

Understanding Personally Identifiable Information (PII):

• PII is essential for identifying an individual, comprising data such as social security numbers, full names, or email addresses.
• Direct identifiers (e.g., passport information) and indirect identifiers (e.g., race, place of birth) are the two types of PII, with the former being unique to an individual and the latter requiring a combination to identify a person.

Challenges Associated with PII:

• The variances in data protection regulations globally create a complex environment for organizations.
• The European Union’s General Data Protection Regulation (GDPR) sets a broad definition of personal data, complicating compliance for multinational corporations. Further, the organizational affiliations and political opinions are protected as PII under GDPR, whereas other jurisdictions might not classify these as sensitive.
• Other issues include Privacy, Data Management, and Safety Concerns.

Cyber Laws of India:

• In India, cybercrime is addressed through both the Indian Penal Code and the Information Technology Act, 2000, which cover a range of activities where computers can be both the tool and the target.

Way Forward:

Creating Data Privacy Frameworks: Organizations are encouraged to develop frameworks that outline how PII is handled, protected, and when necessary, securely disposed of. This involves identifying PII, categorizing it based on sensitivity, and applying appropriate protections.

Minimizing PII Collection and Usage: The principle of data minimization calls for limiting PII collection and retention to what is strictly necessary, disposing of it responsibly when no longer needed.

Applying Data Security Controls: Security controls such as encryption and identity management are crucial. For example: Implementing two-factor or multifactor authentication; and Adopting a zero-trust architecture.

Tailoring Controls to Sensitivity Levels: It’s advised to apply stringent controls to sensitive data while balancing security and convenience for less sensitive data to avoid operational inefficiencies.

Adhering to Best Practices: Organizations and individuals should follow best practices in areas such as web application security, email security, wireless security, and awareness of phishing attacks.