India backs open source software for e-governance projects

India has said it will use open source software in all e-governance projects, though it did not rule out the use of proprietary software to meet specialized requirements.

A policy document released by the federal government over the weekend makes it mandatory for all new e-governance projects and upgrades of existing legacy systems by federal agencies and participating states to first consider free and open source software (OSS) alternatives.

Federal and state agencies must make it mandatory for suppliers to give OSS a preference over proprietary or closed source software while responding to requests for proposals. Suppliers shall provide justification for exclusion of OSS in their response, according to the policy statement posted to the website of the Ministry for Communication & Information Technology.

The Indian government has outlined its Digital India program that aims to make government services accessible online to citizens in their localities. The need to expand these services quickly at a low cost has likely prompted the decision in favor of open source in the country.

The government has also cited strategic control over its e-governance applications and systems from a long-term perspective as one of the reasons it was backing open source.

It is a well drafted policy though policy researchers will always have possible improvements, said Sunil Abraham, executive director of the Centre for Internet and Society, a research organization in Bangalore. Instead of coming up with a new definition for free and open source software, the policy should have used the definitions available at the Free Software Foundation and Open Source Initiative websites and adopted licenses approved by these organizations, he added.

The policy should also require that the software be made available on a public code repository except in cases where there are some security concerns, Abraham said.

The federal government had previously declined to take a stand in favor of open source, leaving the choice to its agencies, but the National Policy on Information Technology, 2012 had mentioned the promotion of open source and open technologies as one of its objectives.

Some states have backed open source software on ideological grounds or to cut costs. Kerala, for example, had decided to promote free and open-source software in education as way back as 2006.

The government in its new policy has, however, provided for exemptions in certain specialized domains for which OSS may not be available, or if there isnt expertise in the particular area in open source. The requirement for OSS may also be waived if the deployment is strategic and urgent.

More:
India backs open source software for e-governance projects

Wikileaks TTP Leak; Chevron And Ecuador Is The Argument In Favour Of The Investment Chapter

Wikileaks has released a version of the investment chapter in the Trans-Pacific Partnership Agreement, the trade treaty under discussion at present. As a result the usual suspects are up in arms about the denial of democracy, the selling out of the law to corporate interests and all the usual malarkey. All most puzzling as the actual intention of this part of this treaty is to ensure that governments have to live up to the laws and contracts that they, as governments, sign up to. And that really is it. The mechanism by which this is done is that any arguments or cases where theres a decision to be made about whether the government has lived up to what it said it will do are decided outside of the court systems controlled by that government. As someone who has, at the personal level, done substantial work in the sort of countries where this would be important it sounds like a great idea to me. And as a matter of public policy it sounds like a great idea that a trade treaty should contain such protections for investors.

What really confuses is people I regard as normally being reasonably level headed near losing their minds over this. I dont cover tech in the way I used to so I was unaware that Cory Doctorow is on very much the wrong side of this:

The Investment Chapter highlights the intent of the TPP negotiating parties, led by the United States, to increase the power of global corporations by creating a supra-national court, or tribunal, where foreign firms can sue states and obtain taxpayer compensation for expected future profits. These investor-state dispute settlement (ISDS) tribunals are designed to overrule the national court systems. ISDS tribunals introduce a mechanism by which multinational corporations can force governments to pay compensation if the tribunal states that a countrys laws or policies affect the companys claimed future profits. In return, states hope that multinationals will invest more. Similar mechanisms have already been used. For example, US tobacco company Phillip Morris used one such tribunal to sue Australia (June 2011 ongoing) for mandating plain packaging of tobacco products on public health grounds; and by the oil giant Chevron Chevron against Ecuador in an attempt to evade a multi-billion-dollar compensation ruling for polluting the environment.

Yes, Chevron has used this sort of treaty provision in that case with Ecuador. And this is a perfect example of why such treaty provisions are so useful: if not essential. Doctorow is there actually quoting Julian Assange which is perhaps why that quote manages to get this entirely the wrong way around. But it confuses even when its Assange himself saying such things. Wikileaks has shown us that certain governments are, at certain times, lying hounds. But as soon as we come to matters of economic governance theyre pure as the driven snow? What?

For heres what has actually happened in that Chevron and Ecuador case. Yes, yes, theres lots of accusations one way and the other but a rough outline seems to be that the Ecuadorean court that Chevron was dragged before was, how shall we put this, less respectful of the full evidence than we might hope for? For we have at least one other court declaring that the plaintiffs had actually been writing parts of the supposedly expert and neutral evidence. And again, at least one non-Ecuadorean court finding that corrupt means had been used to gain the original verdict in the Ecuadorean courts.

Please note that Im not arguing that Chevron did or did not pollute the area in which they drilled for oil. Nor that they shouldnt clean it up if they did, or that it was right or wrong for Ecuador to sign off that Chevron owed no more in this matter (or whether such a sign off happened, or is legal if it did). My argument is much simpler than that. Given what we know has been happening in this case who is going to trust the Ecuadorean courts on this matter? Quite: thus it all needs to be decided by some non-Ecuadorean legal system. Which is exactly what is happening under the investment chapter of the trade agreement which covers this matter, with arbitration running through The Hague.

So, far, from this Chevron case being an example of the terrors to which TTIP will subject the world its an example of why we actually want such investor protections. Because if the government controls the courts and the government is also the actor changing the law then we really might not want those courts to be deciding upon who should be compensated over changes in the law.

We can pick another example as well: anyone want to ask Bill Browder about how lovely it is to have the Russian courts ruling on his cases in Russia?

Investors deserve and need protection from government. And when in a foreign country we need that protection to come from some judicial system that is not under the control of said government.

Think of it this way for a moment. Here in Europe weve got the European Court of Human Rights in Strasbourg. This is part of the Council of Europe, not the European Union. And the basic contention of the entire system is that we cannot, not always at least, trust the governments of the nation states to properly protect the human rights of the citizenry. We thus have a legal system outside, and above, those national systems to ensure that such human rights are fully protected. All that the investment chapter in TTIP is doing is creating a similar system for the economic rights of investors in foreign countries. If your argument is that youve been done over by the local government then you probably dont want your case about it being run through the local courts presumably under the control of that local government.

See the article here:
Wikileaks TTP Leak; Chevron And Ecuador Is The Argument In Favour Of The Investment Chapter

The FBI used to recommend encryption. Now they want to ban it

FBI Director James Comey doesnt want you to encrypt your phone...for your own safety, of course. Photograph: Susan Walsh/AP

The FBI wants to make us all less safe. At least thats the implication from FBI director Jim Comeys push to ban unbreakable encryption and deliberately weaken everyones security. And its past time that the White House makes its position clear once and for all.

Comey was back before Congress this week - this time in front of the House Appropriations Committee - imploring Congressmen to pass a law that would force tech companies to create a backdoor in any phone or communications tool that uses encryption.

He also revealed the Obama administration may be crafting such a law right now. One of the things that the administration is working on right now is what would a legislative response look like that would allow us with court process to get access to that evidence, he said.

The whole controversy stems from Apples decision to encrypt iPhones by default - so that only the user can unlock a phone with a pin or password and even Apple itself does not have the key. It was a huge step forward for security, and given that the US government considers cybersecurity attacks a more dire threat than terrorism, youd think theyd be encouraging everyone to use more encryption. But Comey essentially argued to Congress that because encryption sometimes makes FBI investigations harder, it should be outlawed.

The idea that all of a sudden the FBI is going dark and wont be able to investigate criminals anymore thanks to a tiny improvement of cell phone security is patently absurd. Even if the phone itself is protected by a passphrase that encrypts the device, the FBI can still go to telecom companies to get all the phone metadata they want. They can also still track anyone they choose by getting a cell phones location information 24 hours a day, and of course they can still wiretap the calls themselves. Lets not forget that with a four digit passcode - like iPhones come with by default - can easily broken into by the FBI without anyones help anyways. So a vast majority of this debate is already moot.

Beyond a few vague hypotheticals, Comey wouldnt give any specific examples at the hearing about where this has tripped up the FBI before, but the last time the FBI did, what they said was immediately debunked as nonsense.

If you want to understand why encryption is important for protecting your data, look no further than the FBIs own website. Well, at least you could until last week. For years, the FBI recommended people enable encryption on their phone to protect themselves against criminals, but at some point prior to Comeys testimony, the FBI scrubbed that information from public view. (On 27 March the FBI told the National Journal that the security tips were not intentionally deleted, but were because of the agencys ongoing website redesign.)

In other words, as security expert Jonathan Zdziarski remarked, the FBI has weakened their recommended standards [and] best practices to intentionally leave you vulnerable to security breaches. Computer science professor Matt Blaze put it another way: Basically, the FBI is saying that they think youre more likely to commit a crime than need to protect yourself against crime.

The only thing worse than Comeys position was the know-nothing members of the Appropriations Committee, who at various times were fawning all over Comeys proposal and displaying zero knowledge about basic technological precepts. The video of the back-and-forth is cringe worthy.

Follow this link:
The FBI used to recommend encryption. Now they want to ban it

The FBI wants your computer and mobile to be insecure

You'd think that governments would be encouraging people to keep their computers and personal data safe. Until relatively recently, this has been exactly what the FBI has been pushing -- suggesting that phone users should enable encryption on their handsets. But it seems that there has been something of a change of heart. It's probably Snowden's fault.

Now, as part of an "ongoing website redesign", advice about using encryption and protective PINs has vanished from the FBI website. Forget the security-focused devices such as the Blackphone 2, it appears that the bureau wants your data, and you, to be insecure.

As noted by TechDirt, the FBI website previously included an advice section entitled "safety tips to protect your mobile device". This has now gone, although it can still be seen on the Internet Archive's oh-so-helpful backup. The FBI no longer suggests that phone users enable encryption on their handset to protect their data and their privacy. But this is far from the end of the story.

Speaking on Wednesday, FBI Director James Comey made a call for a ban on encryption. This is not something that came completely out of the blue, it's something he has been pursuing for some time now. Of course it would be a little crazy to just make such a call with no justification behind it, and Comey was ready to pull on heart strings with a doom and gloom vision of a world in which an individual's privacy is seen as being of the utmost importance.

Rather than welcoming a future in which privacy is seen as key, he calls on those who believe in such a vision to imagine something a little darker: a world in which "pedophiles can't be seen, kidnappers can't be seen, drug dealers can't be seen". But this is only one side of the story. The flipside of the coin is that a world in which pedophiles, kidnappers and drug dealers can be seen is a world in which everyone else can also be seen. Nothing to hide, nothing to fear is the common comeback, but that's really not the point.

People are very quick to question this likes of Google when the company tracks user data for targeted advertising and other purposes. But this is something that people, essentially, sign up for. You use Google and you know that your online activities are going to be monitored to some extent. It's a given. Being monitored by the government, however, is an entirely different matter. The very way in which NSA surveillance was carried out demonstrated perfectly that the people collecting data do not know what they're doing or what they're looking for.

With Comey and his ilk pushing for technology company to build backdoors (which we know can be problematic) into all of their products and services that offer encryption. He views encryption as a "huge problem" -- but it's also an incredibly valuable tool for individuals. Encryption with backdoors is as good as no encryption, which is precisely what Comey would like.

Edward Snowden has previously criticized Amazon for failing to encrypt user data (as have others), and with a rise in security attacks, it's little wonder that, on the whole, there is an increased interest in data encryption. The FBI and other organization should be encouraging people to be safer, not pushing for a drop in security simply because it makes surveillance easier.

Photo credit: spiber.de / Shutterstock

Read the original here:
The FBI wants your computer and mobile to be insecure

OneCoin GLOBAL Trend Cryptocurrency 1 . A powerful Opportunity – Video


OneCoin GLOBAL Trend Cryptocurrency 1 . A powerful Opportunity
A powerful Opportunity - https://www.onecoin.eu/signup/slavagold OneCoin provides a once in a lifetime opportunity, revolutionizing the business world of todays digital economy. The OneCoin...

By: A powerful Opportunity work FOR YOU

Visit link:
OneCoin GLOBAL Trend Cryptocurrency 1 . A powerful Opportunity - Video

Digital certificates and encryption keys a growing stress for UK organisations

Home News Security Digital certificates and encryption keys a growing stress for UK organisations Many IT professionals don't know where they are or whether they're safe from attack, says Venafi

Share

UK IT professionals are starting to worry about encryption keys and certificates. Many dont know how many their organisations possess or even where some are stored. All of them think these assets are now under attack.

These are the findings of a Ponemon report for US key and certificate management firm Venafi, which crunched the views of 2,300 IT professionals from the US, Australia, France, Germany, with 499 from the UK.

Once the bedrock of security, keys and certificates now elicit anxiety. This is perhaps not surprising given the growing number of attacks in which they have been compromised or undermined in a more general way by vulnerabilities such as last years Heartbleed.

The average UK organisation in the survey tended 25,500 keys and certificates, with 4 percent of IT staff saying they had no idea where all of this was kept.

Alluding to a famous Black Hat presentation from 2013, many now feared some kind of cryptoapocalypse, the idea that there might come a time in the relatively near future when the factoring algorithms that underlie todays encryption systems crumble in the face of encryption-cracking systems.

It sounds far-fetched but in truth todays IT teams have more practical worries to occupy them before they start pondering alarming thought experiments designed by mathematicians.

The use of encryption keys and to some extent digital certificates has ballooned in the reports words, making their management incredibly difficult.

Whether they realise it or not, every business and government relies upon cryptographic keys and digital certificates to operate. Without the trust established by keys and certificates, wed be back to the Internet stone age not knowing if a website, device, or mobile application can be trusted, said Venafis vice president of security strategy, Kevin Bocek.

Read the original post:
Digital certificates and encryption keys a growing stress for UK organisations