Encrypted and sensitive data of the Intelligence Bureau and the National Investigation Agency besides those of border-guarding and paramilitary forces like the elite NSG could have been breached by the US. The Union Home Ministry has raised an alarm over the token/components (used for two-factor authentication to prevent identity theft) supplied by US multinational RSA to many Government agencies in India.
The alarm comes close on the heels of revelations about India being high on the agenda of US snooping activities with the Centre formally taking up the issue with the American authorities.RSA had deliberately created “backdoor” at the behest of National Security Agency of the US by willingly rendering their encryption product to have access to the Indian critical infrastructures which are using products of the American multinational, said a Union Home Ministry note.
Many Government organisations in India are using RSA products, making them vulnerable to cyber theft and attacks, the MHA maintained.Two-factor authentication is a two-step verification process to verify the identity of an entity trying to access services in a computer or in a network.Following the concerns, the Union Home Ministry’s “secret” advisory to the paramilitary forces, IB and NIA alerted about the security vulnerabilities and sought measures to procure such security products only from indigenous designers only.
To further buttress its concerns, the note issued by the Internal Security division of the Ministry said, “The Cipher Policy Committee (CPC) under the Scientific Analysis Group, DRDO has not cleared any security product of the RSA.Also, CPC has not been allowing, as a policy, COTS (commercial off-the-shelf) security products for protecting information of higher security classification by sensitive Government organisations and insists on use of indigenous encryption technologies provided by trusted designers/developers.”
“It is therefore advised to sensitise the agencies/organizations under your jurisdiction regarding the vulnerabilities in the tokens/components supplied by RSA and the risks associated with them so that such security solutions are not used inadvertently,” said Director of Internal Security-I division, Rakesh Mittal in the classified note sent on May 2 to all the organizations/offices under the Ministry.
The note has been sent to border guarding forces Indo-Tibetan Border Police, Border Security Force, Sasashtra Seema Bal besides Central Reserve Police Force, Central Industrial Security Force, NSG and Assam Rifles. The advisory has also been sent to the IB and NIA.
RSA is a US multinational company providing products that are basically used to carry out two factor authentication through encryption of data to prevent identity theft.Besides the US, the company maintains offices in India, China, Hong Kong, Australia, Ireland, Israel, the United Kingdom, Singapore and Japan.India has been a major target of US’ NSA’s secret surveillance programme for collecting telephone data and internet records. India stood at the fifth position in the overall list of countries spied on by the US, according to the documents released by NSA whistleblower Edward Snowden last year. Huge data from telephone and internet networks was secretly mined in just 30 days.
The American agency carried out intelligence gathering activities in India using at least two major programmes — Boundless Informant, a data-mining system which keeps track of how many calls and emails are collected by the security agency — and PRISM, a programme which intercepts and collects actual content from the networks.While Boundless Informant was used for monitoring telephone calls and access to the internet in India, PRISM collected information about certain specific issues - not related to terrorism - through Google, Microsoft, Facebook, Yahoo, Apple, YouTube and several other web-based services.